fix(ci): use triple-quoted strings in gitleaks.toml to avoid quote parsing errors

fix(ci): fix gitleaks.toml regex syntax - glob to regex patterns
docs(ci): update security scan briefing with gitleaks fix details + PR264 review
2026-07-13 16:56:40 +08:00 · 2026-07-13 16:54:20 +08:00 · 2026-07-13 16:51:46 +08:00 · 2026-07-13 16:50:45 +08:00 · 2026-07-13 16:39:44 +08:00 · 2026-07-13 16:26:26 +08:00
65 changed files with 686 additions and 960 deletions
@@ -3,6 +3,7 @@
 # ==================== 应用配置 ====================
 APP_NAME=小虾 SaaS
 APP_BASE_URL=http://localhost:3000
+APP_ENV=development

 # ==================== 数据库配置 ====================
 DATABASE_URL=postgresql://xiaoxia_user:your_password@localhost:5432/xiaoxia_saas
@@ -35,7 +36,8 @@ ENVIRONMENT=development
 DEBUG=true

 # ==================== CORS 配置 ====================
-CORS_ORIGINS=["http://localhost:3000","http://localhost:5173"]
+# 逗号分隔的域名列表（Settings 读取 CORS_ORIGINS_RAW）
+CORS_ORIGINS_RAW=http://localhost:3000,http://localhost:5173

 # ==================== 阿里云 OSS 配置 ====================
 OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
@@ -49,6 +51,7 @@ OSS_BUCKET_NAME=xiaoxia-autocut
 #       cosyvoice-v3-plus (高质量，系统音色少)
 #       cosyvoice-v3.5-flash / cosyvoice-v3.5-plus (仅支持克隆/设计音色，无系统音色)
 # 音色: v3系列系统音色带 _v3 后缀，如 longxiaochun_v3, longxiaoxia_v3, longanyang (无后缀)
+# 注意：COSYVOICE_* 变量由 packages/shared/config.py 的 SharedSettings 读取
 COSYVOICE_API_KEY=your-cosyvoice-api-key
 COSYVOICE_BASE_URL=https://dashscope.aliyuncs.com/api/v1
 COSYVOICE_MODEL=cosyvoice-v3-flash
@@ -84,6 +84,104 @@ jobs:
          python3 -m pip --version
          echo "CI environment is ready"

+
+      - name: Secret detection (gitleaks)
+        shell: sh
+        run: |
+          set -eu
+          echo "=== Installing gitleaks ==="
+          GITLEAKS_VERSION="v8.18.4"
+          GITLEAKS_ARCH="linux_x64"
+          GITLEAKS_FILE="gitleaks_${GITLEAKS_VERSION#v}_${GITLEAKS_ARCH}.tar.gz"
+          GITHUB_BASE="https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/${GITLEAKS_FILE}"
+          
+          # 国内镜像源（按大致稳定性排序）
+          MIRRORS="
+            https://gh-proxy.com/${GITHUB_BASE}
+            https://ghproxy.net/${GITHUB_BASE}
+            https://hub.gitmirror.com/${GITHUB_BASE}
+            https://ghps.cc/${GITHUB_BASE}
+            https://mirror.ghproxy.com/${GITHUB_BASE}
+            ${GITHUB_BASE}
+          "
+          
+          INSTALLED=false
+          for url in $MIRRORS; do
+            echo "Trying: $url"
+            if curl -fsSL --connect-timeout 8 --max-time 90 --retry 2 --retry-delay 3 \
+                 -o /tmp/gitleaks.tar.gz "$url" 2>/dev/null; then
+              echo "Download successful from: $url"
+              if tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks 2>/dev/null; then
+                chmod +x /tmp/gitleaks
+                /tmp/gitleaks version
+                INSTALLED=true
+                break
+              else
+                echo "Download OK but tar extraction failed, trying next..."
+              fi
+            else
+              echo "Download failed from: $url, trying next..."
+            fi
+          done
+          
+          # Fallback: 尝试 go install 从源码编译
+          if [ "$INSTALLED" = "false" ] && command -v go >/dev/null 2>&1; then
+            echo "All binary mirrors failed, trying go install..."
+            if go install github.com/gitleaks/gitleaks/v8@${GITLEAKS_VERSION} 2>/dev/null; then
+              GOPATH_BIN="$(go env GOPATH)/bin"
+              if [ -x "$GOPATH_BIN/gitleaks" ]; then
+                cp "$GOPATH_BIN/gitleaks" /tmp/gitleaks
+                chmod +x /tmp/gitleaks
+                /tmp/gitleaks version
+                INSTALLED=true
+                echo "Installed via go install"
+              fi
+            fi
+          fi
+          
+          if [ "$INSTALLED" = "false" ]; then
+            echo "WARNING: Failed to install gitleaks from all sources"
+            echo "gitleaks 安装失败，密钥检测跳过（告警模式，不阻断流水线）"
+            echo "请检查Runner网络或手动安装gitleaks到Runner"
+            exit 0
+          fi
+          echo ""
+          echo "=== Running gitleaks scan ==="
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            echo "PR mode: scanning changed files (origin/${{ github.base_ref }}..HEAD)"
+            set +e
+            /tmp/gitleaks detect \
+              --source . \
+              --config .gitleaks.toml \
+              --verbose \
+              --exit-code 1 \
+              --log-opts="origin/${{ github.base_ref }}..HEAD"
+            GITLEAKS_EXIT=$?
+            set -e
+          else
+            echo "Push mode: full repository scan"
+            set +e
+            /tmp/gitleaks detect \
+              --source . \
+              --config .gitleaks.toml \
+              --verbose \
+              --exit-code 1
+            GITLEAKS_EXIT=$?
+            set -e
+          fi
+          if [ "$GITLEAKS_EXIT" = "1" ]; then
+            echo ""
+            echo "=========================================="
+            echo "ERROR: Secrets detected!"
+            echo "=========================================="
+            echo "If these are false positives, add them to .gitleaks.toml allowlist."
+            exit 1
+          elif [ "$GITLEAKS_EXIT" != "0" ]; then
+            echo "WARNING: gitleaks exited with code $GITLEAKS_EXIT (non-zero but not detection failure)"
+            echo "This may indicate a configuration issue. Continuing for now..."
+          else
+            echo "gitleaks scan completed - no secrets detected"
+          fi
      - name: Install dependencies
        shell: sh
        run: |
@@ -97,6 +195,38 @@ jobs:
          bandit --version
          pytest --version

+
+      - name: Python dependency vulnerability scan (pip-audit)
+        shell: sh
+        run: |
+          set -eu
+          echo "=== Installing pip-audit ==="
+          python3 -m pip install -q pip-audit
+          pip-audit --version
+          echo ""
+          echo "=== Scanning Python dependencies ==="
+          set +e
+          HAS_VULN=0
+          for req_file in requirements.txt requirements-base.txt requirements-dev.txt requirements-worker.txt; do
+            if [ -f "$req_file" ]; then
+              echo "--- Scanning $req_file ---"
+              pip-audit -r "$req_file" --desc on 2>&1 | head -30
+              EXIT_CODE=${PIPESTATUS[0]:-0}
+              if [ "$EXIT_CODE" = "1" ]; then
+                HAS_VULN=1
+              fi
+              echo ""
+            fi
+          done
+          set -e
+          echo "=== Summary ==="
+          if [ "$HAS_VULN" = "1" ]; then
+            echo "WARNING: Vulnerabilities found in dependencies."
+          else
+            echo "No known vulnerabilities found in scanned requirements."
+          fi
+          echo "Mode: advisory only (not blocking CI)"
+          exit 0
      - name: Run code quality checks
        shell: sh
        run: |
@@ -0,0 +1,71 @@
+# .gitleaks.toml - gitleaks 白名单配置
+# 仓库: xiaoxia/xiaoxia-saas
+# 用途: 排除已知的测试密钥、示例配置等误报
+# 注意: paths 使用正则表达式(Regex)，不是 glob 语法
+
+# 允许路径/文件排除
+[allowlist]
+description = "全局白名单 - 排除示例配置和测试文件"
+paths = [
+    # 环境配置示例（无真实密钥）
+    '.env.example',
+    '.env.sample',
+    '\.env\.example$',
+    '\.env\.sample$',
+    # 测试文件
+    'tests/',
+    'test/',
+    # 文档
+    'docs/',
+    '\.md$',
+    '\.rst$',
+    # 前端依赖
+    'node_modules/',
+    # Python包
+    'site-packages/',
+    # 锁定文件（自动生成）
+    'poetry.lock',
+    'Pipfile.lock',
+    'requirements.*\.txt\.lock',
+    # CI配置本身
+    '.gitea/',
+    # Docker相关
+    'docker-compose.*\.yml',
+    # gitleaks配置自身
+    '.gitleaks.toml',
+    # vulture配置
+    'vulture.conf',
+    'vulture_whitelist.py',
+    # 前端构建产物
+    'dist/',
+    'build/',
+    # 图片/二进制文件
+    '\.png$',
+    '\.jpg$',
+    '\.jpeg$',
+    '\.gif$',
+    '\.ico$',
+    '\.svg$',
+    '\.woff$',
+    '\.woff2$',
+    '\.ttf$',
+    # 项目文档
+    'README',
+    'CHANGELOG',
+    'LICENSE',
+]
+
+# 允许的密钥值/占位符正则
+# 使用三引号字符串避免引号转义问题
+regexes = [
+    '''(?i)(your[_-]?password|your[_-]?secret|your[_-]?key|your[_-]?token|changeme|change[_-]?me|placeholder|example[_-]?key|test[_-]?key|dummy|fake|mock|xxx|none|not[_-]?set|TODO|FIXME)''',
+    '''postgresql://[^:]+:changeme@''',
+    '''postgresql://[^:]+:your-password@''',
+    '''postgresql://[^:]+:password@localhost''',
+    '''redis://:changeme@''',
+    '''redis://:your-redis-password@''',
+    '''(?i)jwt[_-]?secret\s*[:=]\s*["']?(your[_-]?jwt|change|placeholder|secret|example)''',
+    '''postgresql://postgres:postgres@''',
+    '''redis://localhost''',
+    '''mysql://root:root@''',
+]
@@ -1 +0,0 @@
-"""API application package."""
@@ -1 +0,0 @@
-"""API package."""
@@ -0,0 +1,48 @@
+"""路由层共享辅助函数 — 消除跨文件重复定义。"""
+
+from typing import Any
+
+from fastapi import HTTPException, status
+
+from packages.application import GetProjectUseCase
+from packages.ports.user_repository import UserRepository
+
+
+def check_project_access(project_id: str, user_id: str, project_repository) -> None:
+    """检查用户是否有项目访问权限。
+
+    合并自 asset_libraries.py / edit_plans.py 的同名函数。
+    - 空 project_id 直接放行（兼容 edit_plans 中 project_id 可选的场景）
+    - 错误信息使用中文，与项目其他路由保持一致
+    """
+    if not project_id or not project_id.strip():
+        return
+    project = project_repository.find_by_id(project_id)
+    if project is None:
+        raise HTTPException(status_code=404, detail="项目不存在")
+    if not project.can_access(user_id):
+        raise HTTPException(status_code=403, detail="无权访问该项目")
+
+
+def get_user_plan(user_id: str, user_repository: UserRepository) -> str:
+    """获取用户的订阅计划名称。"""
+    user = user_repository.find_by_id(user_id)
+    if user is None:
+        return "free"
+    return getattr(user, "subscription_plan", "free") or "free"
+
+
+def require_project_and_library(
+    project_id: str,
+    library_id: str,
+    project_repository: Any,
+    asset_library_repository: Any,
+) -> None:
+    """Verify project and asset library exist."""
+    project = GetProjectUseCase(project_repository).execute(project_id)
+    if project is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
+
+    libraries = asset_library_repository.find_by_project(project_id)
+    if not any(item.id == library_id for item in libraries):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Asset library not found")
@@ -22,18 +22,11 @@ from packages.application import (
 )
 from packages.domain import AssetLibrary, AssetLibraryKind

+from ._helpers import check_project_access
+
 router = APIRouter()


-def _check_project_access(project_id: str, user_id: str, project_repository) -> None:
-    """检查用户是否有项目访问权限"""
-    project = project_repository.find_by_id(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-    if not project.can_access(user_id):
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
-
-
 def _to_asset_library_response(item) -> AssetLibraryResponse:
    return AssetLibraryResponse(
        id=item.id,
@@ -168,7 +161,7 @@ def delete_asset_library(
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="素材库不存在")

    # 权限校验：检查用户是否有项目访问权限
-    _check_project_access(library.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(library.project_id, authenticated_user.user.id, project_repository)

    # 删除库内所有素材（无 FK 级联，需手动清理）
    assets_in_library = asset_repository.find_by_library(library_id)
@@ -27,6 +27,8 @@ from packages.application import (
 )
 from packages.domain import AssetStatus, ClassificationStatus

+from app.api.routes._helpers import check_project_access
+
 logger = logging.getLogger(__name__)

 router = APIRouter()
@@ -72,14 +74,6 @@ def _to_asset_response(item, storage_service=None) -> AssetResponse:
    )


-def _check_project_access(project_id: str, user_id: str, project_repository) -> None:
-    """检查用户是否有项目访问权限"""
-    project = project_repository.find_by_id(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-    if not project.can_access(user_id):
-        raise HTTPException(status_code=403, detail="Access denied to project")
-

@router.get("", response_model=ListAssetsResponse)
 def list_assets(
@@ -136,7 +130,7 @@ def list_assets(
            library = asset_library_repository.get(library_id)
            if library is None:
                raise HTTPException(status_code=404, detail=f"AssetLibrary {library_id} not found")
-            _check_project_access(library.project_id, user_id, project_repository)
+            check_project_access(library.project_id, user_id, project_repository)
            if ft:
                items = asset_repository.find_by_library_and_file_type(library_id, ft, skip=skip, limit=limit)
                total = asset_repository.count_by_project(library.project_id) if not kind else len(items)
@@ -152,7 +146,7 @@ def list_assets(

        # 模式2：指定 project_id
        if project_id:
-            _check_project_access(project_id, user_id, project_repository)
+            check_project_access(project_id, user_id, project_repository)
            if ft:
                # 无直接方法，加载后按 file_type 过滤（仍比全量加载好）
                all_items = asset_repository.find_by_project(project_id)
@@ -210,13 +204,13 @@ def list_assets(
        library = asset_library_repository.get(library_id)
        if library is None:
            raise HTTPException(status_code=404, detail=f"AssetLibrary {library_id} not found")
-        _check_project_access(library.project_id, user_id, project_repository)
+        check_project_access(library.project_id, user_id, project_repository)
        if kind:
            all_items = asset_repository.find_by_library_and_file_type(library_id, kind_to_file_type[kind])
        else:
            all_items = asset_repository.find_by_library(library_id)
    elif project_id:
-        _check_project_access(project_id, user_id, project_repository)
+        check_project_access(project_id, user_id, project_repository)
        all_items = asset_repository.find_by_project(project_id)
    else:
        try:
@@ -262,7 +256,7 @@ def update_asset_review_status(
    item = asset_repository.get(asset_id)
    if item is None:
        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(item.project_id, authenticated_user.user.id, project_repository)
    _apply_asset_review_status(item, request.review_status)
    updated = asset_repository.update(item)
    return _to_asset_response(updated)
@@ -286,7 +280,7 @@ def batch_delete_assets(
            failed_ids.append(asset_id)
            continue
        try:
-            _check_project_access(item.project_id, user_id, project_repository)
+            check_project_access(item.project_id, user_id, project_repository)
            deleted_ids.append(asset_id)
        except HTTPException:
            failed_ids.append(asset_id)
@@ -307,7 +301,7 @@ def get_asset(
    item = asset_repository.find_by_id(asset_id)
    if item is None:
        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(item.project_id, authenticated_user.user.id, project_repository)
    return _to_asset_response(item)


@@ -322,7 +316,7 @@ def update_asset(
    item = asset_repository.find_by_id(asset_id)
    if item is None:
        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(item.project_id, authenticated_user.user.id, project_repository)

    # 合并可修改字段
    if request.name is not None:
@@ -346,7 +340,7 @@ def delete_asset(
    item = asset_repository.find_by_id(asset_id)
    if item is None:
        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(item.project_id, authenticated_user.user.id, project_repository)
    asset_repository.delete(asset_id)


@@ -363,7 +357,7 @@ def tag_asset(
    item = asset_repository.find_by_id(asset_id)
    if item is None:
        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(item.project_id, authenticated_user.user.id, project_repository)
    for tag_id in request.tag_ids:
        tag = tag_repository.get(tag_id)
        if tag is None:
@@ -387,7 +381,7 @@ def untag_asset(
    item = asset_repository.find_by_id(asset_id)
    if item is None:
        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(item.project_id, authenticated_user.user.id, project_repository)
    item.remove_tag(tag_id)
    asset_repository.update(item)

@@ -206,7 +206,7 @@ async def verify_email_post(
    return _verify_email_token(request.token, user_repository)


-@router.post("/password/forgot", response_model=MessageResponse, status_code=status.HTTP_202_ACCEPTED)
+@router.post("/forgot-password", response_model=MessageResponse, status_code=status.HTTP_202_ACCEPTED)
 async def forgot_password(
    request: PasswordResetRequestModel,
    user_repository: UserRepository = Depends(get_user_repository),
@@ -223,7 +223,7 @@ async def forgot_password(
    return MessageResponse(message="如果账户存在，密码重置邮件已发送")


-@router.post("/password/reset", response_model=MessageResponse)
+@router.post("/reset-password", response_model=MessageResponse)
 async def reset_password(
    request: ResetPasswordModel,
    user_repository: UserRepository = Depends(get_user_repository),
@@ -243,7 +243,6 @@ async def logout(
    current_user: AuthenticatedUser = Depends(get_current_user),
 ):
    """登出 - 将当前 token 加入黑名单"""
-    from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

    if credentials:
        try:
@@ -14,7 +14,6 @@ from typing import Any
 from uuid import uuid4

 from app.auth import AuthenticatedUser, get_current_user
-from app.config import get_settings
 from app.core.celery_app import celery_app
 from app.core.storage import OSSStorageService, get_storage_service
 from app.dependencies import (
@@ -35,6 +34,8 @@ from fastapi.params import File

 from packages.application import GetProjectUseCase, SubmitIngestJobCommand, SubmitIngestJobUseCase

+from app.api.routes._helpers import require_project_and_library
+
 router = APIRouter()
 logger = logging.getLogger(__name__)

@@ -113,22 +114,6 @@ def _atomic_check_and_record(upload_id: str, chunk_index: int) -> bool:
            fcntl.flock(f.fileno(), fcntl.LOCK_UN)


-def _require_project_and_library(
-    project_id: str,
-    library_id: str,
-    project_repository: Any,
-    asset_library_repository: Any,
-) -> None:
-    """Verify project and asset library exist"""
-    project = GetProjectUseCase(project_repository).execute(project_id)
-    if project is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-
-    libraries = asset_library_repository.find_by_project(project_id)
-    if not any(item.id == library_id for item in libraries):
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Asset library not found")
-
-
 def _load_upload_meta(upload_id: str) -> dict[str, Any]:
    """Load upload metadata"""
    meta_path = _get_upload_meta_path(upload_id)
@@ -206,7 +191,6 @@ async def init_chunked_upload(
    asset_library_repository: Any = Depends(get_asset_library_repository),
 ) -> ChunkedUploadInitResponse:
    """Initialize chunked upload"""
-    settings = get_settings()

    # Validate file size
    if request.file_size > MAX_FILE_SIZE:
@@ -221,7 +205,7 @@ async def init_chunked_upload(
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")

    # Verify asset library
-    _require_project_and_library(
+    require_project_and_library(
        request.project_id,
        request.library_id,
        project_repository,
@@ -32,12 +32,6 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from pydantic import BaseModel, Field
 from sqlalchemy.orm import Session

-from packages.adapters.sqlalchemy_impl.asset_library_repository import (
-    SQLAlchemyAssetLibraryRepository,
-)
-from packages.adapters.sqlalchemy_impl.asset_repository import (
-    SQLAlchemyAssetRepository,
-)
 from packages.adapters.sqlalchemy_impl.generation_task_repository import (
    SQLAlchemyGenerationTaskRepository,
 )
@@ -51,6 +45,8 @@ from packages.application.generation_tasks import (
    CreateGenerationTaskCommand,
    CreateGenerationTaskUseCase,
 )
+
+from ._helpers import check_project_access
 from packages.domain.config_schemas import normalize_plan_config
 from packages.domain.edit_plan import EditPlan, EditPlanStatus

@@ -247,17 +243,6 @@ class GenerateFromTemplateResponse(BaseModel):
 # ── Helpers ───────────────────────────────────────────────────────────────────


-def _check_project_access(project_id: str, user_id: str, project_repository: Any) -> None:
-    """校验用户对项目的访问权限（参照 assets.py 的 can_access 模式）"""
-    if not project_id or not project_id.strip():
-        return
-    project = project_repository.find_by_id(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail="项目不存在")
-    if not project.can_access(user_id):
-        raise HTTPException(status_code=403, detail="无权访问该项目")
-
-
 def _to_response(p: EditPlan) -> EditPlanResponse:
    return EditPlanResponse(
        id=p.id,
@@ -311,7 +296,7 @@ def list_plans(

    # 项目鉴权：如果指定了 project_id，校验用户是否有权访问
    if project_id:
-        _check_project_access(project_id, current_user.user.id, project_repository)
+        check_project_access(project_id, current_user.user.id, project_repository)

    skip = (page - 1) * page_size
    plans = svc.list_plans(
@@ -353,7 +338,7 @@ def get_plan(
        )
    # 项目鉴权
    if plan.project_id:
-        _check_project_access(plan.project_id, current_user.user.id, project_repository)
+        check_project_access(plan.project_id, current_user.user.id, project_repository)
    return _to_response(plan)


@@ -369,7 +354,7 @@ def create_plan(
    project_id = (body.project_id or "").strip()
    # 项目鉴权
    if project_id:
-        _check_project_access(project_id, current_user.user.id, project_repository)
+        check_project_access(project_id, current_user.user.id, project_repository)
    svc = EditPlanService(db)
    # 标准化 config，填充 cover/title/subtitle/bgm 默认值
    normalized_config = normalize_plan_config(body.config)
@@ -411,7 +396,7 @@ def update_plan(
    if existing is None:
        raise HTTPException(status_code=404, detail=f"剪辑计划不存在: {plan_id}")
    if existing.project_id:
-        _check_project_access(existing.project_id, current_user.user.id, project_repository)
+        check_project_access(existing.project_id, current_user.user.id, project_repository)

    # 基础字段更新
    try:
@@ -465,7 +450,7 @@ def delete_plan(
    # 项目鉴权
    existing = svc.get_plan(plan_id)
    if existing and existing.project_id:
-        _check_project_access(existing.project_id, current_user.user.id, project_repository)
+        check_project_access(existing.project_id, current_user.user.id, project_repository)
    deleted = svc.delete_plan(plan_id)
    if not deleted:
        raise HTTPException(
@@ -507,7 +492,7 @@ def generate_plan(
    if plan_check is None:
        raise HTTPException(status_code=404, detail=f"剪辑计划不存在: {plan_id}")
    if plan_check.project_id:
-        _check_project_access(plan_check.project_id, current_user.user.id, project_repository)
+        check_project_access(plan_check.project_id, current_user.user.id, project_repository)

    # ── 自动兜底 1: draft → editing ──────────────────────────────────────
    if plan_check.status == EditPlanStatus.DRAFT:
@@ -710,7 +695,7 @@ def generate_plan(
    except HTTPException:
        # 已处理的 HTTP 异常直接透传
        raise
-    except Exception as exc:
+    except Exception:
        logger.exception("触发剪辑计划生成失败: plan_id=%s", plan_id)
        # 尝试将计划标记为失败（RENDERING → FAILED 是合法的状态流转）
        try:
@@ -749,7 +734,7 @@ def get_generation_status(
    plan = gen_status["plan"]
    # 项目鉴权
    if plan.project_id:
-        _check_project_access(plan.project_id, current_user.user.id, project_repository)
+        check_project_access(plan.project_id, current_user.user.id, project_repository)
    clips = gen_status["clips"]

    clip_items = [
@@ -791,7 +776,7 @@ def list_plan_generations(
    # 验证计划存在 + 项目鉴权
    plan = svc.get_plan_or_raise(plan_id)
    if plan.project_id:
-        _check_project_access(plan.project_id, current_user.user.id, project_repository)
+        check_project_access(plan.project_id, current_user.user.id, project_repository)

    gen_task_repo = SQLAlchemyGenerationTaskRepository(db)
    tasks = gen_task_repo.list_by_source_edit_plan(plan_id)
@@ -860,7 +845,7 @@ def ai_recommend_clips(

    # 项目鉴权
    if plan.project_id:
-        _check_project_access(plan.project_id, current_user.user.id, project_repository)
+        check_project_access(plan.project_id, current_user.user.id, project_repository)

    # 验证状态：只允许 draft 或 editing
    plan_status = plan.status.value if hasattr(plan.status, "value") else plan.status
@@ -909,7 +894,7 @@ def ai_recommend_clips(
            config=normalized_config,
            total_duration=result["total_duration"],
        )
-    except Exception as exc:
+    except Exception:
        logger.exception("AI 推荐写入失败，plan_id=%s 数据可能不一致", plan_id)
        # 尝试回滚未提交的变更
        try:
@@ -990,7 +975,7 @@ def generate_cover(

    # 项目鉴权
    if plan.project_id:
-        _check_project_access(plan.project_id, current_user.user.id, project_repository)
+        check_project_access(plan.project_id, current_user.user.id, project_repository)

    # 调用 AI 封面生成服务
    from apps.worker.worker_app.tasks.ai_tasks import run_generate_cover
@@ -1110,7 +1095,7 @@ def get_plan_timeline(
    plan = svc.get_plan_or_raise(plan_id)
    # 项目鉴权
    if plan.project_id:
-        _check_project_access(plan.project_id, current_user.user.id, project_repository)
+        check_project_access(plan.project_id, current_user.user.id, project_repository)

    clips = svc.list_clips(plan_id=plan_id, skip=0, limit=200)
    # 按 order 排序
@@ -1171,7 +1156,7 @@ def generate_from_template(

    # 项目鉴权
    if body.project_id:
-        _check_project_access(body.project_id, current_user.user.id, project_repository)
+        check_project_access(body.project_id, current_user.user.id, project_repository)

    template_svc = EditTemplateService(db)

@@ -32,6 +32,8 @@ from app.schemas.generation_task import (
 )
 from fastapi import APIRouter, Depends, HTTPException

+from app.api.routes._helpers import check_project_access
+
 from packages.application import (
    CreateGenerationTaskCommand,
    CreateGenerationTaskUseCase,
@@ -43,15 +45,6 @@ logger = logging.getLogger(__name__)

 router = APIRouter()

-def _check_project_access(project_id: str, user_id: str, project_repository) -> None:
-    """检查用户是否有项目访问权限"""
-    project = project_repository.find_by_id(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-    if not project.can_access(user_id):
-        raise HTTPException(status_code=403, detail="Access denied to project")
-
-
 def _to_generation_task_response(task) -> GenerationTaskResponse:
    return GenerationTaskResponse(
        id=task.id,
@@ -339,7 +332,7 @@ def get_generation_task(
    if task is None:
        raise HTTPException(status_code=404, detail=f"GenerationTask {task_id} not found")
    if task.project_id:
-        _check_project_access(task.project_id, authenticated_user.user.id, project_repository)
+        check_project_access(task.project_id, authenticated_user.user.id, project_repository)
    return _to_generation_task_response(task)


@@ -356,7 +349,7 @@ def list_generation_results(
    if task is None:
        raise HTTPException(status_code=404, detail=f"GenerationTask {task_id} not found")
    if task.project_id:
-        _check_project_access(task.project_id, authenticated_user.user.id, project_repository)
+        check_project_access(task.project_id, authenticated_user.user.id, project_repository)
    use_case = ListGeneratedVideosByTaskUseCase(generated_video_repository)
    items = use_case.execute(task_id)
    responses = []
@@ -20,7 +20,7 @@ from typing import Any

 from app.auth import AuthenticatedUser, get_current_user
 from app.core.celery_app import celery_app
-from app.dependencies import get_db_session, get_job_repository, get_project_repository
+from app.dependencies import get_job_repository, get_project_repository
 from app.schemas.job import (
    CompleteJobRequest,
    CreateJobRequest,
@@ -51,6 +51,8 @@ from packages.application.jobs import (
 )
 from packages.domain.job import JobType

+from app.api.routes._helpers import check_project_access
+
 logger = logging.getLogger(__name__)

 router = APIRouter()
@@ -66,15 +68,6 @@ _JOB_TYPE_TO_CELERY_TASK: dict[str, str] = {
 }


-def _check_project_access(project_id: str, user_id: str, project_repository) -> None:
-    """检查用户是否有项目访问权限。"""
-    project = project_repository.find_by_id(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-    if not project.can_access(user_id):
-        raise HTTPException(status_code=403, detail="Access denied to project")
-
-
 # ── 创建任务 ──────────────────────────────────────────────────────────────────


@@ -89,7 +82,7 @@ def create_job(

    创建后任务处于 pending 状态，需要调用 /submit 提交执行。
    """
-    _check_project_access(request.project_id, authenticated_user.user.id, project_repository)
+    check_project_access(request.project_id, authenticated_user.user.id, project_repository)

    # 校验 job_type
    try:
@@ -182,7 +175,7 @@ def list_project_jobs(
    offset: int = Query(default=0, ge=0),
 ) -> ListJobsResponse:
    """获取项目下的任务列表。"""
-    _check_project_access(project_id, authenticated_user.user.id, project_repository)
+    check_project_access(project_id, authenticated_user.user.id, project_repository)

    use_case = ListJobsUseCase(job_repo)
    jobs = use_case.execute(
@@ -204,7 +197,7 @@ def get_job_statistics(
    project_repository: Any = Depends(get_project_repository),
 ) -> JobStatisticsResponse:
    """获取项目任务统计摘要。"""
-    _check_project_access(project_id, authenticated_user.user.id, project_repository)
+    check_project_access(project_id, authenticated_user.user.id, project_repository)

    use_case = GetJobStatisticsUseCase(job_repo)
    stats = use_case.execute(project_id)
@@ -33,6 +33,8 @@ from packages.application.recipe.use_cases import (
 )
 from packages.ports.user_repository import UserRepository

+from app.api.routes._helpers import get_user_plan
+
 router = APIRouter()


@@ -40,13 +42,6 @@ def _get_recipe_repository(session: Session = Depends(get_db_session)) -> SQLAlc
    return SQLAlchemyRecipeRepository(session)


-def _get_user_plan(user_id: str, user_repository: UserRepository) -> str:
-    user = user_repository.find_by_id(user_id)
-    if user is None:
-        return "free"
-    return getattr(user, "subscription_plan", "free") or "free"
-
-
 def _item_to_response(item) -> RecipeItemResponse:
    return RecipeItemResponse(
        id=item.id,
@@ -194,7 +189,7 @@ def use_recipe(
    user_repository: UserRepository = Depends(get_user_repository),
 ) -> UseRecipeResponse:
    user_id = authenticated_user.user.id
-    plan_name = _get_user_plan(user_id, user_repository)
+    plan_name = get_user_plan(user_id, user_repository)
    use_case = UseRecipeUseCase(recipe_repository)
    try:
        result = use_case.execute(recipe_id, user_id, user_plan=plan_name)
@@ -232,7 +232,7 @@ async def payment_callback(

        # 创建账单记录
        record_id = uuid.uuid4().hex
-        record = repo.create(
+        repo.create(
            {
                "id": record_id,
                "user_id": user_id,
@@ -28,6 +28,8 @@ from packages.application.title_library.use_cases import (
 )
 from packages.ports.user_repository import UserRepository

+from app.api.routes._helpers import get_user_plan
+
 router = APIRouter()


@@ -51,13 +53,6 @@ def _to_response(item) -> TitleLibraryItemResponse:
    )


-def _get_user_plan(user_id: str, user_repository: UserRepository) -> str:
-    user = user_repository.find_by_id(user_id)
-    if user is None:
-        return "free"
-    return getattr(user, "subscription_plan", "free") or "free"
-
-
@router.get("", response_model=ListTitleLibraryResponse)
 def list_titles(
    category: Optional[str] = Query(None),
@@ -98,7 +93,7 @@ def create_title(
    user_repository: UserRepository = Depends(get_user_repository),
 ) -> TitleLibraryItemResponse:
    user_id = authenticated_user.user.id
-    plan_name = _get_user_plan(user_id, user_repository)
+    plan_name = get_user_plan(user_id, user_repository)
    command = CreateTitleLibraryCommand(
        user_id=user_id,
        name=request.name,
@@ -1,5 +1,5 @@
 import logging
-from typing import Annotated, Any
+from typing import Any
 from uuid import uuid4

 from app.auth import AuthenticatedUser, get_current_user
@@ -17,12 +17,13 @@ from app.schemas.upload import (
    DirectUploadCompleteResponse,
    DirectUploadPrepareRequest,
    DirectUploadPrepareResponse,
-    UploadAssetRequest,
    UploadAssetResponse,
 )
 from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status

-from packages.application import GetProjectUseCase, SubmitIngestJobCommand, SubmitIngestJobUseCase
+from packages.application import SubmitIngestJobCommand, SubmitIngestJobUseCase
+
+from app.api.routes._helpers import require_project_and_library

 logger = logging.getLogger(__name__)

@@ -80,21 +81,6 @@ def _validate_mime_type(content_type: str | None) -> str:
    return base_type


-def _require_project_and_library(
-    project_id: str,
-    library_id: str,
-    project_repository: Any,
-    asset_library_repository: Any,
-) -> None:
-    project = GetProjectUseCase(project_repository).execute(project_id)
-    if project is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-
-    libraries = asset_library_repository.find_by_project(project_id)
-    if not any(item.id == library_id for item in libraries):
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Asset library not found")
-
-
 def _submit_ingest_job(
    project_id: str,
    library_id: str,
@@ -135,7 +121,7 @@ async def prepare_direct_upload(
    # P2-5: 服务端验证 MIME 类型
    validated_content_type = _validate_mime_type(request.content_type)

-    _require_project_and_library(
+    require_project_and_library(
        request.project_id,
        request.library_id,
        project_repository,
@@ -183,7 +169,7 @@ async def complete_direct_upload(
    storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> DirectUploadCompleteResponse:
    """确认浏览器直传完成并创建导入任务。"""
-    _require_project_and_library(
+    require_project_and_library(
        request.project_id,
        request.library_id,
        project_repository,
@@ -252,7 +238,7 @@ async def upload_asset(
    storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> UploadAssetResponse:
    """上传素材文件并触发导入流水线。"""
-    _require_project_and_library(project_id, library_id, project_repository, asset_library_repository)
+    require_project_and_library(project_id, library_id, project_repository, asset_library_repository)

    # ── 素材去重检测：上传前检查同素材库 + 同 file_hash ──
    if file_hash:
@@ -28,7 +28,6 @@ from packages.application.voice_clone.use_cases import (
    VoiceCloneNotRetryableError,
 )
 from packages.application.voice_clone.workflow import (
-    VoiceCloneWorkflowError,
    VoiceCloneWorkflowService,
 )

@@ -39,6 +39,8 @@ from packages.application.voice_library.use_cases import (
 from packages.domain.preset_voices import PRESET_VOICES
 from packages.ports.user_repository import UserRepository

+from app.api.routes._helpers import get_user_plan
+
 router = APIRouter()


@@ -125,13 +127,6 @@ def _preset_to_unified_response(preset) -> UnifiedVoiceItemResponse:
    )


-def _get_user_plan(user_id: str, user_repository: UserRepository) -> str:
-    user = user_repository.find_by_id(user_id)
-    if user is None:
-        return "free"
-    return getattr(user, "subscription_plan", "free") or "free"
-
-
 # ==================== 统一配音列表（预置 + 克隆）====================


@@ -271,7 +266,7 @@ def create_voice(
    sign_url=Depends(get_audio_url_signer),
 ) -> VoiceLibraryItemResponse:
    user_id = authenticated_user.user.id
-    plan_name = _get_user_plan(user_id, user_repository)
+    plan_name = get_user_plan(user_id, user_repository)
    command = CreateVoiceLibraryCommand(
        user_id=user_id,
        name=request.name,
@@ -25,7 +25,7 @@ class Settings(BaseSettings):
    DATABASE_POOL_SIZE: int = 20
    DATABASE_MAX_OVERFLOW: int = 10  # 调整为合理值：pool_size(20) + max_overflow(10) = 最大30连接
    DATABASE_POOL_TIMEOUT: int = 30
-    DATABASE_POOL_RECYLE: int = 3600
+    DATABASE_POOL_RECYCLE: int = 3600
    USE_IN_MEMORY_DB: bool = False
    AUTO_CREATE_SCHEMA: bool = False

@@ -41,6 +41,11 @@ class Settings(BaseSettings):
    # 密钥轮换天数（到达此天数后建议更换密钥）
    SECRET_ROTATION_DAYS: int = 90

+    # JWT 算法与过期时间（与 .env.example 对齐）
+    JWT_ALGORITHM: str = "HS256"
+    JWT_ACCESS_TOKEN_EXPIRE_MINUTES: int = 30
+    JWT_REFRESH_TOKEN_EXPIRE_DAYS: int = 30
+
    @field_validator("JWT_SECRET_KEY", mode="before")
    @classmethod
    def validate_jwt_secret_key(cls, v):
@@ -1 +0,0 @@
-"""Core configuration package."""
@@ -50,20 +50,8 @@ from packages.adapters.sqlalchemy_impl.voice_clone_profile_repository import (
 from packages.adapters.sqlalchemy_impl.voice_library_repository import (
    SQLAlchemyVoiceLibraryRepository,
 )
-from packages.ports.asset_library_repository import AssetLibraryRepository
-from packages.ports.asset_repository import AssetRepository
-from packages.ports.classification_job_repository import ClassificationJobRepository
-from packages.ports.duplication_repository import DuplicationRecordRepository
-from packages.ports.generated_video_repository import GeneratedVideoRepository
-from packages.ports.generation_task_repository import GenerationTaskRepository
-from packages.ports.ingest_job_repository import IngestJobRepository
-from packages.ports.job_repository import JobRepository
-from packages.ports.project_repository import ProjectRepository
 from packages.ports.tag_repository import TagRepository
-from packages.ports.title_library_repository import TitleLibraryRepository
 from packages.ports.user_repository import UserRepository
-from packages.ports.voice_clone_profile_repository import VoiceCloneProfileRepository
-from packages.ports.voice_library_repository import VoiceLibraryRepository

 _engine, _SessionLocal = build_session_factory(settings.DATABASE_URL)

@@ -10,7 +10,7 @@ from __future__ import annotations
 from app.auth import AuthenticatedUser
 from app.auth import get_current_user as get_authenticated_user
 from app.dependencies import get_user_repository
-from fastapi import Depends
+from fastapi import Depends, HTTPException
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer

 from packages.domain.entities import User
@@ -6,7 +6,7 @@ import logging
 import time
 from typing import Callable

-from fastapi import Request, Response
+from fastapi import Request
 from starlette.middleware.base import BaseHTTPMiddleware

 logger = logging.getLogger(__name__)
@@ -2,7 +2,7 @@

 from __future__ import annotations

-from typing import List, Optional
+from typing import Optional

 from pydantic import BaseModel, Field

@@ -24,7 +24,7 @@ from packages.adapters.sqlalchemy_impl import (
 )
 from packages.domain.asset import AssetType
 from packages.domain.classification import AssetClassification
-from packages.domain.edit_plan_clip import EditPlanClip, EditPlanClipStatus
+from packages.domain.edit_plan_clip import EditPlanClip

 logger = logging.getLogger(__name__)

@@ -18,7 +18,6 @@ from packages.adapters.sqlalchemy_impl import (
 )
 from packages.domain.edit_plan import EditPlan, EditPlanStatus
 from packages.domain.edit_plan_clip import EditPlanClip, EditPlanClipStatus
-from packages.domain.generation_task import GenerationTaskStatus

 logger = logging.getLogger(__name__)

@@ -13,7 +13,6 @@ from __future__ import annotations
 import logging
 from typing import Any

-from sqlalchemy.orm import Session

 from packages.application.jobs import (
    CancelJobUseCase,
@@ -13,7 +13,7 @@
 from __future__ import annotations

 import logging
-from typing import Any, List, Optional
+from typing import Any, List

 from sqlalchemy.orm import Session

@@ -16,7 +16,6 @@ FFmpeg 视频合成编排服务：
 from __future__ import annotations

 import logging
-import shutil
 from dataclasses import dataclass, field
 from typing import Any

@@ -28,7 +27,7 @@ from packages.adapters.sqlalchemy_impl.edit_plan_clip_repository import (
 from packages.adapters.sqlalchemy_impl.edit_plan_repository import (
    SQLAlchemyEditPlanRepository,
 )
-from packages.domain.edit_plan import EditPlan, EditPlanStatus
+from packages.domain.edit_plan import EditPlanStatus
 from packages.domain.edit_plan_clip import EditPlanClip, EditPlanClipStatus
 from packages.domain.template_clip_config import TransitionEffect

@@ -1,42 +0,0 @@
-/**
- * 仪表盘 API
- * Phase 1 新增：用户仪表盘概览
- */
-import apiClient from "./client";
-
-/** 仪表盘概览数据 */
-export interface DashboardOverview {
-  /** 素材总数 */
-  total_assets: number;
-  /** 已用存储（字节） */
-  used_storage_bytes: number;
-  /** 总标题数 */
-  total_titles: number;
-  /** 总配音数 */
-  total_voices: number;
-  /** 生成任务总数 */
-  total_tasks: number;
-  /** 成品总数 */
-  total_products: number;
-  /** 最近生成任务 */
-  recent_tasks: Array<{
-    id: string;
-    task_type: string;
-    status: string;
-    progress: number;
-    user_message: string;
-    created_at: string;
-  }>;
-  /** 订阅信息 */
-  subscription: {
-    plan: "free" | "pro" | "enterprise";
-    status: "active" | "inactive" | "expired";
-    expires_at?: string;
-  };
-}
-
-/** 获取仪表盘概览数据 */
-export const getDashboardOverview = async (): Promise<DashboardOverview> => {
-  const response = await apiClient.get("/dashboard/overview");
-  return response.data;
-};
@@ -1,365 +0,0 @@
-/* V21 业务组件统一样式 */
-
-/* ==================== 按钮 ==================== */
-.xx-primary-btn {
-  background: var(--gradient-primary) !important;
-  color: var(--text-inverse) !important;
-  border: none !important;
-  border-radius: var(--radius-md) !important;
-  padding: 10px 20px !important;
-  font-weight: var(--font-weight-bold) !important;
-  box-shadow: var(--shadow-primary) !important;
-  transition: var(--transition-all) !important;
-  cursor: pointer;
-  height: auto !important;
-}
-
-.xx-primary-btn:hover {
-  box-shadow: var(--shadow-hover) !important;
-  transform: translateY(-1px);
-}
-
-.xx-ghost-btn {
-  background: transparent !important;
-  color: var(--primary-color) !important;
-  border: 2px solid var(--primary-color) !important;
-  border-radius: var(--radius-md) !important;
-  padding: var(--space-sm) 18px !important;
-  font-weight: var(--font-weight-bold) !important;
-  transition: var(--transition-all) !important;
-  cursor: pointer;
-  height: auto !important;
-}
-
-.xx-ghost-btn:hover {
-  background: var(--primary-soft) !important;
-}
-
-/* ==================== 卡片 ==================== */
-.xx-card {
-  background: var(--bg-elevated);
-  border: 1px solid var(--border-color);
-  border-radius: var(--radius-xl);
-  box-shadow: var(--shadow-card);
-  padding: var(--space-lg);
-  margin-bottom: 20px;
-  transition: all var(--transition-slow);
-}
-
-.xx-card:hover {
-  box-shadow: var(--shadow-md);
-  transform: translateY(-2px);
-}
-
-/* ==================== 页面结构 ==================== */
-.xx-page {
-  max-width: 1200px;
-  margin: 0 auto;
-  padding: var(--space-lg);
-}
-
-.xx-page-head {
-  display: flex;
-  justify-content: space-between;
-  align-items: flex-start;
-  gap: 18px;
-  margin-bottom: 28px;
-}
-
-.xx-page-head h2 {
-  font-size: 26px;
-  font-weight: var(--font-weight-extrabold);
-  color: var(--text-primary);
-  margin: 0 0 var(--space-sm);
-}
-
-.xx-page-head p {
-  font-size: var(--font-size-base);
-  color: var(--text-secondary);
-  margin: 0;
-}
-
-/* ==================== 表格样式 ==================== */
-.xx-table-card {
-  background: var(--bg-elevated);
-  border: 1px solid var(--border-color);
-  border-radius: var(--radius-xl);
-  box-shadow: var(--shadow-card);
-  padding: 20px;
-  overflow: hidden;
-}
-
-/* 表格包装器 */
-.xx-table-wrapper {
-  border-radius: var(--radius-lg);
-  overflow: hidden;
-}
-
-/* ==================== 标签/Tag ==================== */
-.xx-tag {
-  padding: var(--space-xs) 12px;
-  border-radius: var(--radius-xs);
-  font-size: 13px;
-  font-weight: var(--font-weight-medium);
-}
-
-.xx-tag-indigo {
-  background: var(--primary-soft);
-  color: var(--primary-color);
-  border: 1px solid var(--color-primary-200);
-}
-
-.xx-tag-success {
-  background: var(--success-soft);
-  color: var(--color-secondary-500);
-  border: 1px solid var(--success-border);
-}
-
-.xx-tag-warning {
-  background: var(--warning-soft);
-  color: var(--accent-dark);
-  border: 1px solid var(--color-accent-200);
-}
-
-.xx-tag-error {
-  background: var(--error-soft);
-  color: var(--error-color);
-  border: 1px solid var(--error-border);
-}
-
-/* ==================== 搜索栏 ==================== */
-.xx-search-bar {
-  margin-bottom: 20px;
-}
-
-.xx-search-input {
-  width: 100%;
-  padding: 12px 18px;
-  border: 2px solid var(--border-color);
-  border-radius: var(--radius-md);
-  font-size: var(--font-size-base);
-  background: var(--bg-primary);
-  transition: var(--transition-all);
-  outline: none;
-}
-
-.xx-search-input:focus {
-  border-color: var(--primary-color);
-  box-shadow: 0 0 0 4px
-    color-mix(in srgb, var(--primary-color) 10%, transparent);
-}
-
-/* ==================== Modal ==================== */
-.xx-modal .ant-modal-content {
-  border-radius: var(--radius-xl);
-  padding: var(--space-lg);
-}
-
-.xx-modal .ant-modal-header {
-  border-radius: var(--radius-xl) var(--radius-xl) 0 0;
-  padding: 20px var(--space-lg);
-  border-bottom: 1px solid var(--border-color);
-}
-
-.xx-modal .ant-modal-title {
-  font-size: var(--font-size-lg);
-  font-weight: var(--font-weight-bold);
-  color: var(--text-primary);
-}
-
-.xx-modal .ant-modal-footer {
-  border-top: 1px solid var(--border-color);
-  padding: var(--space-md) var(--space-lg);
-}
-
-/* ==================== 空状态 ==================== */
-.xx-empty-state {
-  text-align: center;
-  padding: var(--space-3xl) var(--space-lg);
-  color: var(--text-secondary);
-}
-
-.xx-empty-state-icon {
-  font-size: 48px;
-  margin-bottom: var(--space-md);
-}
-
-/* ==================== 网格布局 ==================== */
-.xx-grid-2 {
-  display: grid;
-  grid-template-columns: repeat(2, 1fr);
-  gap: 20px;
-}
-
-.xx-grid-3 {
-  display: grid;
-  grid-template-columns: repeat(3, 1fr);
-  gap: 20px;
-}
-
-.xx-grid-4 {
-  display: grid;
-  grid-template-columns: repeat(4, 1fr);
-  gap: 20px;
-}
-
-@media (max-width: 768px) {
-  .xx-grid-2,
-  .xx-grid-3,
-  .xx-grid-4 {
-    grid-template-columns: 1fr;
-  }
-}
-
-/* ==================== 配额展示 ==================== */
-.xx-quota-item {
-  padding: 20px;
-  background: var(--bg-primary);
-  border: 1px solid var(--border-color);
-  border-radius: var(--radius-lg);
-  transition: var(--transition-all);
-}
-
-.xx-quota-item:hover {
-  border-color: var(--primary-color);
-  box-shadow: 0 8px 24px
-    color-mix(in srgb, var(--primary-color) 10%, transparent);
-}
-
-/* ==================== 进度条 ==================== */
-.xx-progress {
-  margin-top: 12px;
-}
-
-/* ==================== Ant Design 覆盖样式 ==================== */
-/* Table overrides */
-.ant-table-wrapper .ant-table-thead > tr > th {
-  background: var(--bg-secondary) !important;
-  font-weight: var(--font-weight-bold) !important;
-  color: var(--text-primary) !important;
-  border-bottom: 2px solid var(--border-color) !important;
-  padding: 14px var(--space-md) !important;
-}
-
-.ant-table-wrapper .ant-table-tbody > tr > td {
-  padding: 14px var(--space-md) !important;
-  border-bottom: 1px solid var(--color-gray-100) !important;
-}
-
-.ant-table-wrapper .ant-table-tbody > tr:hover > td {
-  background: var(--color-gray-50) !important;
-}
-
-/* Card overrides */
-.ant-card {
-  border-radius: var(--radius-xl) !important;
-  border: 1px solid var(--border-color) !important;
-}
-
-.ant-card-head {
-  border-bottom: 1px solid var(--border-color) !important;
-  min-height: 52px !important;
-  padding: 0 var(--space-lg) !important;
-}
-
-.ant-card-head-title {
-  font-weight: var(--font-weight-bold) !important;
-  font-size: var(--font-size-md) !important;
-  color: var(--text-primary) !important;
-}
-
-.ant-card-body {
-  padding: 20px var(--space-lg) !important;
-}
-
-/* Modal overrides */
-.ant-modal-content {
-  border-radius: var(--radius-xl) !important;
-  overflow: hidden;
-}
-
-.ant-modal-header {
-  padding: 20px var(--space-lg) !important;
-  background: var(--bg-primary) !important;
-}
-
-.ant-modal-title {
-  font-weight: var(--font-weight-bold) !important;
-  font-size: var(--font-size-lg) !important;
-  color: var(--text-primary) !important;
-}
-
-.ant-modal-body {
-  padding: var(--space-lg) !important;
-}
-
-.ant-modal-footer {
-  padding: var(--space-md) var(--space-lg) !important;
-}
-
-/* Button overrides */
-.ant-btn-primary {
-  background: var(--gradient-primary) !important;
-  border: none !important;
-  border-radius: var(--radius-md) !important;
-  box-shadow: var(--shadow-primary) !important;
-  height: auto !important;
-  padding: 10px 20px !important;
-  font-weight: var(--font-weight-bold) !important;
-}
-
-.ant-btn-primary:hover {
-  background: var(--gradient-primary) !important;
-  box-shadow: var(--shadow-hover) !important;
-  transform: translateY(-1px);
-}
-
-/* Tag overrides */
-.ant-tag {
-  border-radius: var(--radius-xs) !important;
-  padding: var(--space-xs) 12px !important;
-  font-weight: var(--font-weight-medium) !important;
-}
-
-/* Select overrides */
-.ant-select-selector {
-  border-radius: var(--radius-md) !important;
-  border-color: var(--border-color) !important;
-}
-
-.ant-select:not(.ant-select-disabled):hover .ant-select-selector {
-  border-color: var(--primary-color) !important;
-}
-
-.ant-select-focused .ant-select-selector {
-  border-color: var(--primary-color) !important;
-  box-shadow: 0 0 0 3px
-    color-mix(in srgb, var(--primary-color) 10%, transparent) !important;
-}
-
-/* Input overrides */
-.ant-input {
-  border-radius: var(--radius-md) !important;
-  border-color: var(--border-color) !important;
-  padding: 10px 14px !important;
-}
-
-.ant-input:hover {
-  border-color: var(--primary-color) !important;
-}
-
-.ant-input:focus {
-  border-color: var(--primary-color) !important;
-  box-shadow: 0 0 0 3px
-    color-mix(in srgb, var(--primary-color) 10%, transparent) !important;
-}
-
-/* Progress overrides */
-.ant-progress-inner {
-  background: var(--color-gray-100) !important;
-  border-radius: var(--radius-xs) !important;
-}
-
-.ant-progress-bg {
-  border-radius: var(--radius-xs) !important;
-}
@@ -1,211 +0,0 @@
-/**
- * 统一导航配置
- * Header 和 Sidebar 共用此数据源
- */
-import React from "react";
-import {
-  DashboardOutlined,
-  VideoCameraOutlined,
-  FileOutlined,
-  AudioOutlined,
-  FileTextOutlined,
-  TrophyOutlined,
-  AppstoreOutlined,
-  HistoryOutlined,
-  ControlOutlined,
-  CrownOutlined,
-  ScanOutlined,
-  EditOutlined,
-  FolderOutlined,
-} from "@ant-design/icons";
-
-/** 导航项定义 */
-export interface NavItem {
-  key: string;
-  label: string;
-  path: string;
-  icon: React.ReactNode;
-}
-
-/** 导航分组定义 */
-export interface NavGroup {
-  title: string;
-  items: NavItem[];
-}
-
-/**
- * 扁平导航列表（Header 使用）
- */
-export const NAV_ITEMS: NavItem[] = [
-  {
-    key: "dashboard",
-    label: "概览",
-    path: "/app/dashboard",
-    icon: <DashboardOutlined />,
-  },
-  {
-    key: "assets",
-    label: "素材库",
-    path: "/app/assets",
-    icon: <FileOutlined />,
-  },
-  {
-    key: "titles",
-    label: "标题库",
-    path: "/app/titles",
-    icon: <FileTextOutlined />,
-  },
-  {
-    key: "voices",
-    label: "配音库",
-    path: "/app/voices",
-    icon: <AudioOutlined />,
-  },
-  {
-    key: "voice-clone",
-    label: "我的音色",
-    path: "/app/voice-clone",
-    icon: <AudioOutlined />,
-  },
-  {
-    key: "voice-materials",
-    label: "配音素材库",
-    path: "/app/voice-materials",
-    icon: <AudioOutlined />,
-  },
-  {
-    key: "templates",
-    label: "模板库",
-    path: "/app/templates",
-    icon: <AppstoreOutlined />,
-  },
-  {
-    key: "editing-planner",
-    label: "剪辑编辑器",
-    path: "/app/editing-planner",
-    icon: <EditOutlined />,
-  },
-  {
-    key: "my-templates",
-    label: "我的模板",
-    path: "/app/my-templates",
-    icon: <FolderOutlined />,
-  },
-  {
-    key: "generate",
-    label: "一键生成",
-    path: "/app/generate",
-    icon: <VideoCameraOutlined />,
-  },
-  {
-    key: "history",
-    label: "任务历史",
-    path: "/app/history",
-    icon: <HistoryOutlined />,
-  },
-  {
-    key: "products",
-    label: "成品库",
-    path: "/app/products",
-    icon: <TrophyOutlined />,
-  },
-  {
-    key: "duplication",
-    label: "查重",
-    path: "/app/duplication",
-    icon: <ScanOutlined />,
-  },
-];
-
-/**
- * 分组导航列表（Sidebar 使用）
- */
-export const NAV_GROUPS: NavGroup[] = [
-  {
-    title: "创作工具",
-    items: [
-      {
-        key: "dashboard",
-        label: "首页",
-        path: "/app/dashboard",
-        icon: <DashboardOutlined />,
-      },
-      {
-        key: "generate",
-        label: "一键生成",
-        path: "/app/generate",
-        icon: <VideoCameraOutlined />,
-      },
-    ],
-  },
-  {
-    title: "资源管理",
-    items: [
-      {
-        key: "assets",
-        label: "素材库",
-        path: "/app/assets",
-        icon: <FileOutlined />,
-      },
-      {
-        key: "voices",
-        label: "配音库",
-        path: "/app/voices",
-        icon: <AudioOutlined />,
-      },
-      {
-        key: "voice-clone",
-        label: "我的音色",
-        path: "/app/voice-clone",
-        icon: <AudioOutlined />,
-      },
-      {
-        key: "voice-materials",
-        label: "配音素材库",
-        path: "/app/voice-materials",
-        icon: <AudioOutlined />,
-      },
-      {
-        key: "titles",
-        label: "标题库",
-        path: "/app/titles",
-        icon: <FileTextOutlined />,
-      },
-      {
-        key: "products",
-        label: "成片库",
-        path: "/app/products",
-        icon: <TrophyOutlined />,
-      },
-      {
-        key: "templates",
-        label: "模板库",
-        path: "/app/templates",
-        icon: <AppstoreOutlined />,
-      },
-    ],
-  },
-  {
-    title: "系统",
-    items: [
-      {
-        key: "history",
-        label: "任务历史",
-        path: "/app/history",
-        icon: <HistoryOutlined />,
-      },
-      {
-        key: "admin",
-        label: "控制台",
-        path: "/app/admin",
-        icon: <ControlOutlined />,
-      },
-      {
-        key: "subscription",
-        label: "订阅管理",
-        path: "/app/subscription",
-        icon: <CrownOutlined />,
-      },
-    ],
-  },
-];
@@ -75,35 +75,6 @@
  margin: 0;
 }

-/* V21 卡片 */
-.xx-card {
-  background: rgba(255, 255, 255, 0.94);
-  border: 1px solid rgba(226, 232, 240, 0.95);
-  border-radius: var(--radius-lg);
-  box-shadow: 0 10px 30px rgba(15, 23, 42, 0.06);
-  padding: 24px;
-  transition: all 0.3s;
-}
-
-.xx-card:hover {
-  box-shadow: 0 16px 40px rgba(15, 23, 42, 0.08);
-}
-
-.xx-card .ant-card-head {
-  border-bottom: 1px solid rgba(226, 232, 240, 0.8);
-  padding: 20px 24px;
-}
-
-.xx-card .ant-card-head-title {
-  font-weight: 800;
-  font-size: 17px;
-  color: var(--slate, #0f172a);
-}
-
-.xx-card .ant-card-body {
-  padding: 24px;
-}
-
 /* 统计卡片网格 - 4列 */
 .xx-grid-4 {
  display: grid;
@@ -302,17 +273,6 @@
  box-shadow: 0 0 0 3px rgba(79, 70, 229, 0.1) !important;
 }

-/* V21 Select */
-.xx-select {
-  border-radius: var(--radius-md) !important;
-}
-
-.xx-select:hover,
-.xx-select:focus {
-  border-color: var(--indigo, #4f46e5) !important;
-  box-shadow: 0 0 0 3px rgba(79, 70, 229, 0.1) !important;
-}
-
 /* V21 Tag */
 .xx-tag {
  border-radius: var(--radius-xs) !important;
@@ -612,54 +612,6 @@
  flex: 1;
 }

-/* ============================================================
-   按钮（匹配原型 .btn .ghost / .btn .primary）
-   ============================================================ */
-.xx-btn {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  gap: 6px;
-  height: 42px;
-  padding: 0 20px;
-  border-radius: var(--radius-sm);
-  font-size: 14px;
-  font-weight: 600;
-  cursor: pointer;
-  transition: all 0.15s ease;
-  border: none;
-  outline: none;
-  white-space: nowrap;
-}
-
-.xx-btn:disabled {
-  opacity: 0.5;
-  cursor: not-allowed;
-}
-
-.xx-btn-primary {
-  background: var(--gradient-primary);
-  color: var(--text-inverse);
-  box-shadow: 0 14px 26px rgba(79, 70, 229, 0.22);
-}
-
-.xx-btn-primary:hover:not(:disabled) {
-  transform: translateY(-2px);
-  box-shadow: 0 18px 34px rgba(79, 70, 229, 0.28);
-}
-
-.xx-btn-ghost {
-  background: var(--bg-primary);
-  border: 1px solid var(--border-color);
-  color: var(--text-secondary);
-}
-
-.xx-btn-ghost:hover:not(:disabled) {
-  border-color: var(--info-border);
-  color: var(--primary-dark);
-  background: var(--primary-soft);
-}
-
 /* ============================================================
   右侧预览区 generate-preview
   ============================================================ */
@@ -170,13 +170,6 @@ export const router = createBrowserRouter([
            Component: m.default,
          })),
      },
-      {
-        path: "my-voices",
-        lazy: () =>
-          import("@/pages/my-voices/MyVoices").then((m) => ({
-            Component: m.default,
-          })),
-      },
      {
        path: "accounts",
        lazy: () =>
@@ -113,8 +113,8 @@ from video_processing.oss_helpers import (
    get_signed_download_url,
    upload_to_oss,
 )
-from video_processing.unified_render_service import UnifiedRenderService
 from video_processing.render_engine_resolver import ENGINE_LEGACY, ENGINE_UNIFIED
+from video_processing.unified_render_service import UnifiedRenderService

 # ── 虚拟 Plan / Clip（内存中构建，不写数据库） ────────────────────────────────

@@ -619,7 +619,8 @@ def _render_with_legacy_engine(
    import subprocess

    main_clips = [
-        c for c in virtual_clips
+        c
+        for c in virtual_clips
        if c.clip_type in ("main", "b_roll", "background")
        or (c.clip_type == "main" and c.config.get("role") == "b_roll")
    ]
@@ -674,17 +675,27 @@ def _render_with_legacy_engine(
    filter_complex = ";".join(fc_parts)

    command = [
-        FFMPEG_BIN, "-y",
+        FFMPEG_BIN,
+        "-y",
        *input_args,
-        "-filter_complex", filter_complex,
-        "-map", video_label,
-        "-map", audio_label,
-        "-c:v", "libx264",
-        "-crf", "23",
-        "-preset", "medium",
-        "-c:a", "aac",
-        "-b:a", "192k",
-        "-movflags", "+faststart",
+        "-filter_complex",
+        filter_complex,
+        "-map",
+        video_label,
+        "-map",
+        audio_label,
+        "-c:v",
+        "libx264",
+        "-crf",
+        "23",
+        "-preset",
+        "medium",
+        "-c:a",
+        "aac",
+        "-b:a",
+        "192k",
+        "-movflags",
+        "+faststart",
        str(output_path),
    ]

@@ -694,7 +705,9 @@ def _render_with_legacy_engine(
    except subprocess.CalledProcessError as e:
        logger.error(
            "[task_id=%s] [渲染] legacy 引擎 FFmpeg 失败: %s\nfilter_complex: %s",
-            task_id, e, filter_complex[:500],
+            task_id,
+            e,
+            filter_complex[:500],
        )
        raise

@@ -880,7 +893,9 @@ def generate_video(self, task_id: str) -> dict:
                render_elapsed = time.monotonic() - render_start
                logger.info(
                    "[task_id=%s] [渲染] legacy 引擎完成: 耗时=%.1fs, 时长=%.2fs",
-                    task_id, render_elapsed, render_duration,
+                    task_id,
+                    render_elapsed,
+                    render_duration,
                )
            else:
                # 新引擎：UnifiedRenderService 图层架构
@@ -901,7 +916,8 @@ def generate_video(self, task_id: str) -> dict:
                render_elapsed = time.monotonic() - render_start
                logger.info(
                    "[task_id=%s] [渲染] unified 引擎完成: 耗时=%.1fs",
-                    task_id, render_elapsed,
+                    task_id,
+                    render_elapsed,
                )

            if gen_task:
@@ -0,0 +1,137 @@
+# 首次安全扫描简报
+
+> 仓库: xiaoxia/xiaoxia-saas
+> 扫描时间: 2026-07-13
+> 负责人: 代码审计 Agent
+> 状态: CI 排队中（Runner 环境修复中），gitleaks 下载链路二次优化已提交，待 CI 跑通后获取真实扫描数据
+
+## 一、概览
+
+| 工具 | 优先级 | PR | 接入状态 | CI 验证 | 扫描结果 |
+|---|---|---|---|---|---|
+| gitleaks（密钥检测） | P0 | [#256](https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/pulls/256) | ✅ 二次优化提交 | 🕐 CI 排队中 | 待验证 |
+| pip-audit（Python 依赖漏洞） | P1 | [#256](https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/pulls/256) | ✅ 代码已提交 | 🕐 CI 排队中 | 待验证 |
+| vulture（死代码检测） | P2 | [#259](https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/pulls/259) | ✅ 代码已提交 | 🕐 等待 black 修复 + CI 排队 | 待验证 |
+
+## 二、各工具详情
+
+### 1. gitleaks 密钥检测（P0）
+
+**接入配置**
+- 位置：validate Job 第 3 步（Verify CI environment 之后）
+- PR 模式：增量扫描（`--log-opts="origin/base..HEAD"`），只扫描改动文件
+- Push 模式：全量扫描
+- 阻断策略：发现密钥直接阻断合并（exit code 1）
+- 白名单：`.gitleaks.toml`，排除以下路径/内容：
+  - `.env.example`、示例配置文件
+  - `tests/`、`docs/`、`node_modules/`、`site-packages/`
+  - 锁定文件（poetry.lock 等）
+  - 占位符字符串（`your-password`、`changeme`、`placeholder` 等）
+
+**下载问题（第二轮修复已提交）**
+- 第一轮修复（ghproxy + 99988866 + GitHub 直连）：全部失败
+  - `mirror.ghproxy.com`: 连接超时（7.7s）
+  - `gh.api.99988866.xyz`: SSL 握手失败
+  - GitHub 直连: 120s 超时，仅下载 1.6MB/2.9MB
+- 第二轮修复（6 个镜像 + go install 降级）：
+  - 新增 4 个国内镜像：`gh-proxy.com`、`ghproxy.net`、`hub.gitmirror.com`、`ghps.cc`
+  - 每个镜像重试 2 次，connect-timeout 8s，max-time 90s
+  - 增加 `go install` 源码编译降级方案
+  - 全部失败时告警跳过（不阻断 CI），避免阻塞开发流程
+- 修复 commit：`fix(ci): add more Chinese mirrors for gitleaks download + graceful degradation`
+
+**长期建议**：在 Runner 镜像中预装 gitleaks 二进制，彻底避免下载问题
+
+**CI 状态**
+- 当前状态：大量 CI 任务排队中（9 个 Runner 在线但任务堆积）
+- 历史失败 Run #4071（旧 Runner）：gitleaks 下载失败（见上）
+- 历史失败 Run #4075（新 Runner）：Job in_progress 但步骤全 queued（新 Runner 执行环境问题）
+- 最新 Run #4096：queued 状态，等待执行
+- 构建运维 Agent 正在修复：Runner 标签匹配 + 新 Runner 执行环境 + 并发优化
+
+### 2. pip-audit Python 依赖漏洞扫描（P1）
+
+**接入配置**
+- 位置：validate Job 第 5 步（Install dependencies 之后）
+- 扫描范围：`requirements.txt`、`requirements-base.txt`、`requirements-dev.txt`、`requirements-worker.txt`
+- 数据源：OSV（PyPA 官方推荐）
+- 阻断策略：告警模式，不阻断 CI
+- 计划：运行 1-2 周摸清漏洞存量后，按严重等级设置阻断阈值
+
+**CI 状态**
+- 同 PR #256，因 Runner 卡住暂未执行
+
+### 3. vulture 死代码检测（P2）
+
+**接入配置**
+- 位置：validate Job，Run security scan (bandit) 之后
+- 置信度阈值：80%
+- 扫描范围：`alembic/`、`apps/`、`packages/`、`scripts/`
+- 排除：测试文件、迁移文件、文档、node_modules、site-packages
+- 白名单：框架自动调用代码
+  - FastAPI routes / dependencies / middleware
+  - SQLAlchemy models / Pydantic schemas
+  - Celery tasks
+  - Alembic migration functions
+  - CLI scripts / 工具函数
+- 阻断策略：告警模式，不阻断 CI
+
+**CI 状态**
+- Workflow Run #4054
+- 失败原因：`scripts/check_migration_safety.py` 不符合 black 格式
+  ```
+  would reformat scripts/check_migration_safety.py
+  1 file would be reformatted, 376 files would be left unchanged.
+  ```
+- 说明：非 vulture 引入的问题（vulture 步骤还没执行到），是其他 Agent 修改了迁移安全检查脚本但没跑 black 格式化
+- 建议：后端开发 Agent 在迁移安全 PR 中同步修复 black 格式问题
+
+## 三、PR #264（前端清理）安全审查
+
+**审查结论：✅ 无安全风险，可合并**
+
+**审查范围**：PR #264 `cleanup/phase3-frontend` → `develop`，6 个文件变更（+261/-1359 行）
+
+**检查项**：
+| 检查项 | 结果 | 说明 |
+|---|---|---|
+| 危险 DOM 操作（innerHTML/eval 等） | ✅ 通过 | 未发现 dangerouslySetInnerHTML、eval、document.write 等 |
+| 硬编码密钥/Token | ✅ 通过 | 未发现 API Key、Secret、Password 等硬编码 |
+| 本地存储操作（localStorage 等） | ✅ 通过 | 未新增本地存储操作 |
+| 开放重定向漏洞 | ✅ 通过 | 未新增 window.location / redirect 操作 |
+| 新增第三方依赖 | ✅ 通过 | 仅新增 `@ant-design/icons` 的 DatabaseOutlined 图标 |
+| 删除文件安全性 | ✅ 通过 | 删除 `apps/web/src/api/accounts.ts`（Mock API 文件），无安全影响 |
+
+**核心变更性质**：
+- 删除 Mock 数据（accounts.ts），替换为真实 API 调用或占位
+- 清理 Admin.css 冗余样式（-460 行）
+- Dashboard / GeneratePage / TitleLibrary 页面 Mock 替换为真实数据调用
+- 整体净删除 1098 行，代码量减少，攻击面缩小
+
+## 四、发现的其他 CI 问题
+
+### Runner 环境问题
+1. **新服务器 Runner 卡住**：`xiaoxia-ci-runner-new-2` 上的 Job 一直停留在 queued 状态，无法执行步骤
+2. **Unit Tests 快速失败**：Unit Tests Job 18 秒就失败了，可能是环境/依赖问题，非代码问题
+3. **Integration Tests 快速失败**：24 秒失败，同样可能是环境问题
+
+### 代码质量预存问题
+1. `scripts/check_migration_safety.py` 不符合 black 格式（可能是后端开发刚改动过）
+
+## 五、下一步计划
+
+1. **等待 CI 环境修复**：构建运维修复 Runner 标签匹配 + 执行环境 + 并发配置后，CI 才能正常运行
+2. **收集首次扫描数据**：CI 跑通后，第一时间整理 gitleaks / pip-audit / vulture 的首次真实扫描结果
+3. **根据结果调优白名单**：如有误报，及时更新 `.gitleaks.toml` 和 `vulture_whitelist.py`
+4. **跟进 PR #259 black 格式问题**：等待后端开发修复 `check_migration_safety.py` 后 rebase 验证 vulture
+5. **推动 gitleaks 预装**：建议在 Runner 镜像中预装 gitleaks，彻底规避下载链路问题
+6. **推进 npm audit**：前端开发 PR #260 已提交 npm audit，等待 CI 验证
+7. **PR #264 合并**：安全审查通过，CI 跑通后可合并
+
+## 六、相关文档
+
+- [安全工具接入方案](docs/ci/代码安全扫描CI集成方案_report.md)
+- [安全工具路线图](docs/ci/security-scanning-roadmap.md)
+- [gitleaks 白名单配置](../.gitleaks.toml)
+- [vulture 配置](../vulture.conf)
+- [vulture 白名单](../vulture_whitelist.py)
@@ -0,0 +1,105 @@
+# 安全与质量扫描工具接入路线图
+
+> 仓库: xiaoxia/xiaoxia-saas
+> 更新时间: 2026-07-13
+> 负责人: 代码审计 Agent
+
+## 整体概览
+
+```
+Phase 0 (已完成)    Phase 1 (进行中)    Phase 2 (规划中)    Phase 3 (远期)
+ ─────────────      ──────────────      ─────────────      ────────────
+  bandit             gitleaks (P0)       npm audit (P1)     mypy (类型检查)
+  (已存在)           pip-audit (P1)      vulture (P2)       semgrep (SAST)
+                     迁移安全检查                           依赖自动更新
+                                                           License 合规
+```
+
+## 各阶段详情
+
+### Phase 0: 基线能力（已存在）
+
+| 工具 | 类型 | 状态 | 说明 |
+|---|---|---|---|
+| bandit | Python 代码安全审计 | ✅ 已接入 | validate Job 中运行，`-ll` 级别，阻断模式 |
+| black | 代码格式化 | ✅ 已接入 | `--check --fast` 模式，阻断模式 |
+| isort | 导入排序 | ✅ 已接入 | `--check-only` 模式，阻断模式 |
+| flake8 | 代码风格 | ✅ 已接入 | 阻断模式 |
+| compileall | 语法检查 | ✅ 已接入 | Python 编译检查 |
+
+### Phase 1: 安全基础（进行中 / P0-P1）
+
+预计完成时间：2026-07-13 ~ 2026-07-14
+
+#### P0: gitleaks 密钥检测
+- **状态**: ✅ PR 已提交 ([PR #256](https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/pulls/256))，CI 验证中
+- **接入位置**: validate Job（最前面，快速反馈）
+- **扫描模式**:
+  - PR 触发：增量扫描（只扫改动文件）
+  - 主分支 push：全量扫描
+- **阻断策略**: 发现密钥直接阻断合并
+- **配置文件**: `.gitleaks.toml`（白名单排除示例配置、测试文件等）
+- **预估收益**: 防止 API Key、密码、Token 等敏感信息泄露
+
+#### P1: pip-audit Python 依赖漏洞扫描
+- **状态**: ✅ PR 已提交（同 PR #256），CI 验证中
+- **接入位置**: validate Job（依赖安装后）
+- **扫描范围**: 全部 4 个 requirements 文件
+- **数据源**: OSV（PyPA 官方推荐）
+- **阻断策略**: 告警模式（初期不阻断）
+  - 运行 1-2 周摸清漏洞存量
+  - 评估后根据严重程度设置阻断阈值（HIGH/CRITICAL 阻断）
+- **预估收益**: 及时发现 Python 依赖中的 CVE 漏洞
+
+### Phase 2: 质量与前端安全（P1-P2）
+
+预计启动时间：Phase 1 稳定后（约 2026-07-15 ~ 2026-07-18）
+
+#### P1: npm audit 前端依赖漏洞扫描
+- **状态**: 📋 规划中（前端开发负责）
+- **接入位置**: frontend-lint Job
+- **扫描范围**: `package.json` / `package-lock.json`
+- **初始阈值**: `--audit-level=high`
+- **阻断策略**: 告警模式（初期不阻断）
+- **相关 PR**: PR#255（前端缓存优化）后续接入
+
+#### P2: vulture 死代码检测
+- **状态**: ✅ PR 已提交 ([PR #259](https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas/pull/259))
+- **接入位置**: validate Job（安全扫描之后）
+- **置信度阈值**: 80%（逐步调高）
+- **扫描范围**: `alembic` / `apps` / `packages` / `scripts`
+- **白名单**: 框架自动调用代码（FastAPI routes、SQLAlchemy models、Celery tasks 等）
+- **阻断策略**: 告警模式（不阻断）
+  - 运行 1-2 周统计死代码存量
+  - 分批清理确认的死代码
+  - 稳定后逐步提高置信度并考虑阻断
+- **预估收益**: 减少维护负担，降低安全攻击面
+
+### Phase 3: 深度质量（远期规划）
+
+预计启动时间：Phase 2 完成后（约 2026-07 下旬）
+
+| 工具 | 类型 | 优先级 | 说明 |
+|---|---|---|---|
+| mypy | 类型检查 | P1 | 先宽松模式，逐步收紧，提升代码质量 |
+| semgrep | SAST 静态分析 | P2 | 自定义规则集，检测特定安全模式 |
+| 依赖自动更新 | 依赖管理 | P2 | Dependabot / Renovate，自动更新依赖版本 |
+| License 合规 | 合规检查 | P3 | 检查第三方依赖的 License 是否合规 |
+
+## 接入原则
+
+1. **先告警后阻断**：新工具初期一律告警模式，摸清存量后再设阈值
+2. **增量优先**：PR 阶段增量扫描，主分支全量扫描，平衡速度与覆盖
+3. **白名单先行**：提前配置好合理的白名单，减少误报干扰
+4. **分层递进**：P0 → P1 → P2 → P3，按优先级逐步接入
+5. **文档同步**：每个工具接入都同步更新接入方案和最佳实践
+
+## 进度跟踪
+
+| 阶段 | 工具 | PR | 状态 | 备注 |
+|---|---|---|---|---|
+| Phase 1 | gitleaks | #256 | 🟡 CI 验证中 | 国内镜像下载修复已提交 |
+| Phase 1 | pip-audit | #256 | 🟡 CI 验证中 | 告警模式 |
+| Phase 2 | vulture | #259 | 🟡 等待 CI | 80% 置信度，告警模式 |
+| Phase 2 | npm audit | - | 📋 规划中 | 前端开发负责 |
+| Phase 3 | mypy | - | 📋 规划中 | 后端开发负责（同迁移安全 PR） |
@@ -1 +0,0 @@
-"""Packages root."""
@@ -1 +0,0 @@
-"""Adapters package for external implementations."""
@@ -1,6 +1,6 @@
 from datetime import datetime, timezone

-from sqlalchemy import JSON, Boolean, Column, DateTime, Float, Integer, String, Text, UniqueConstraint, create_engine
+from sqlalchemy import JSON, Boolean, Column, DateTime, Float, Integer, String, Text, UniqueConstraint
 from sqlalchemy.orm import declarative_base

 Base = declarative_base()
@@ -27,7 +27,6 @@ from .generated_videos import (
 from .generation_tasks import (
    CreateGenerationTaskCommand,
    CreateGenerationTaskUseCase,
-    GetGenerationTaskUseCase,
 )
 from .ingest_jobs import SubmitIngestJobCommand, SubmitIngestJobUseCase
 from .jobs import (
@@ -12,10 +12,9 @@ JWT 处理器委托层
    payload = jwt_handler.verify_access_token(token)
 """

-from datetime import datetime, timedelta
 from typing import Any, Dict, Optional

-from packages.application.auth.jwt_service import JWTConfig, JWTService, TokenType
+from packages.application.auth.jwt_service import JWTConfig, JWTService


 class JWTHandler:
@@ -208,10 +208,10 @@ def _get_jwt_service():
        kw = dict(secret_key=settings.JWT_SECRET_KEY)
        if hasattr(settings, "JWT_ALGORITHM"):
            kw["algorithm"] = settings.JWT_ALGORITHM
-        if hasattr(settings, "ACCESS_TOKEN_EXPIRE_MINUTES"):
-            kw["access_token_expire_minutes"] = settings.ACCESS_TOKEN_EXPIRE_MINUTES
-        if hasattr(settings, "REFRESH_TOKEN_EXPIRE_DAYS"):
-            kw["refresh_token_expire_days"] = settings.REFRESH_TOKEN_EXPIRE_DAYS
+        if hasattr(settings, "JWT_ACCESS_TOKEN_EXPIRE_MINUTES"):
+            kw["access_token_expire_minutes"] = settings.JWT_ACCESS_TOKEN_EXPIRE_MINUTES
+        if hasattr(settings, "JWT_REFRESH_TOKEN_EXPIRE_DAYS"):
+            kw["refresh_token_expire_days"] = settings.JWT_REFRESH_TOKEN_EXPIRE_DAYS
        _jwt_service_instance = JWTService(JWTConfig(**kw))
    return _jwt_service_instance

@@ -293,7 +293,7 @@ class LogoutUseCase:
        try:
            if request.logout_all_devices:
                # 删除所有设备的 session
-                count = self.session_store.delete_all_user_sessions(request.user_id)
+                self.session_store.delete_all_user_sessions(request.user_id)
                return True, None
            else:
                # 删除当前 session
@@ -85,8 +85,6 @@ class PasswordHasher:
            True 如果需要重新哈希
        """
        try:
-            hashed_bytes = hashed_password.encode("utf-8")
-            current_rounds = bcrypt.getsalt(hashed_bytes)

            # 提取当前的 cost factor
            # bcrypt hash 格式: $2b$rounds$salt+hash
@@ -3,7 +3,7 @@
 """

 import secrets
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 from typing import Optional
 from uuid import uuid4

@@ -3,7 +3,7 @@
 """

 from math import ceil
-from typing import Generic, List, Optional, TypeVar
+from typing import Generic, List, TypeVar

 from pydantic import BaseModel, Field

@@ -7,9 +7,7 @@ from __future__ import annotations

 import logging
 from dataclasses import dataclass, field
-from datetime import datetime, timezone
 from typing import Any
-from uuid import uuid4

 from packages.domain.job import Job, JobStatus, JobType
 from packages.ports.job_repository import JobRepository
@@ -9,7 +9,6 @@ from typing import List, Optional
 from packages.adapters.sqlalchemy_impl.recipe_repository import SQLAlchemyRecipeRepository
 from packages.application.recipe.commands import (
    CreateRecipeCommand,
-    RecipeItemCommand,
    UpdateRecipeCommand,
 )
 from packages.domain.recipe import Recipe, RecipeItem
@@ -1 +0,0 @@
-"""TTS Job application layer."""
@@ -148,7 +148,6 @@ class TTSStreamingService:

        # 并发合成所有分段，按顺序流式推送
        queue: asyncio.Queue[tuple[int, Optional[bytes], Optional[str]]] = asyncio.Queue()
-        completed_count = 0

        async def _synthesize_one(idx: int, seg_text: str) -> None:
            """合成单个分段并放入队列。"""
@@ -24,7 +24,7 @@ from packages.application.cosyvoice_service import (
    CosyVoiceError,
    CosyVoiceService,
 )
-from packages.application.tts_job.audio_merger import AudioMergeError, AudioMerger
+from packages.application.tts_job.audio_merger import AudioMerger
 from packages.application.tts_job.text_splitter import split_text
 from packages.domain.tts_job import TTSJob, TTSJobStatus
 from packages.ports.tts_job_repository import TTSJobRepository
@@ -2,7 +2,6 @@

 from __future__ import annotations

-import uuid
 from typing import List, Optional

 from packages.domain.voice_clone_profile import VoiceCloneProfile
@@ -10,7 +10,7 @@
 from __future__ import annotations

 import logging
-from typing import Any, Optional
+from typing import Optional

 from packages.application.cosyvoice_service import (
    CosyVoiceAuthError,
@@ -21,9 +21,8 @@ from packages.application.voice_clone.use_cases import (
    CreateVoiceCloneUseCase,
    RetryVoiceCloneUseCase,
    VoiceCloneNotFoundError,
-    VoiceCloneNotRetryableError,
 )
-from packages.domain.voice_clone_profile import VoiceCloneProfile, VoiceCloneStatus
+from packages.domain.voice_clone_profile import VoiceCloneProfile
 from packages.ports.voice_clone_profile_repository import VoiceCloneProfileRepository

 logger = logging.getLogger(__name__)
@@ -13,7 +13,6 @@ else:
        pass


-from typing import Any
 from uuid import uuid4


@@ -10,7 +10,7 @@ from __future__ import annotations

 import copy
 from enum import Enum
-from typing import List, Optional
+from typing import Optional

 from pydantic import BaseModel, Field

@@ -24,7 +24,7 @@ from __future__ import annotations

 import logging
 from dataclasses import dataclass, field
-from typing import Any, Dict, Optional, Set
+from typing import Dict, Optional

 logger = logging.getLogger(__name__)

@@ -14,7 +14,7 @@ from __future__ import annotations
 import logging
 from dataclasses import dataclass, field
 from enum import Enum
-from typing import Any, Callable, Dict, List, Optional, Set
+from typing import Any, Callable, Dict, List, Optional

 logger = logging.getLogger(__name__)

@@ -2,7 +2,7 @@

 from abc import ABC, abstractmethod

-from packages.domain import AssetLibrary, AssetLibraryKind
+from packages.domain import AssetLibrary


 class AssetLibraryRepository(ABC):
@@ -247,3 +247,4 @@ def main() -> int:

 if __name__ == "__main__":
    sys.exit(main())
+
@@ -19,9 +19,10 @@ from unittest.mock import MagicMock, patch
 os.environ.setdefault("JWT_SECRET_KEY", "unit-test-secret-key-for-testing")
 os.environ.setdefault("DATABASE_URL", "sqlite:///test.db")

-import pytest
 from pathlib import Path

+import pytest
+
 # ── Mock worker 模块以避免数据库连接 ──────────────────────────────────────────

 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "apps", "worker"))
@@ -68,11 +69,12 @@ class _TestClip:

 def test_resolver_unified_when_enabled_100_percent():
    """flag 全局开启（percentage=100）时，返回 unified。"""
+    from video_processing.render_engine_resolver import RenderEngineResolver
+
    from packages.adapters.redis.feature_flag_store import (
        FeatureFlagConfig,
        InMemoryFeatureFlagStore,
    )
-    from video_processing.render_engine_resolver import RenderEngineResolver

    store = InMemoryFeatureFlagStore()
    store.set(FeatureFlagConfig(name="render_engine", enabled=True, percentage=100))
@@ -83,11 +85,12 @@ def test_resolver_unified_when_enabled_100_percent():

 def test_resolver_legacy_when_flag_disabled():
    """flag 全局关闭时，返回默认引擎 legacy。"""
+    from video_processing.render_engine_resolver import RenderEngineResolver
+
    from packages.adapters.redis.feature_flag_store import (
        FeatureFlagConfig,
        InMemoryFeatureFlagStore,
    )
-    from video_processing.render_engine_resolver import RenderEngineResolver

    store = InMemoryFeatureFlagStore()
    store.set(FeatureFlagConfig(name="render_engine", enabled=False, percentage=100))
@@ -98,11 +101,12 @@ def test_resolver_legacy_when_flag_disabled():

 def test_resolver_whitelist_overrides_percentage_0():
    """白名单用户即使 percentage=0 也走 unified。"""
+    from video_processing.render_engine_resolver import RenderEngineResolver
+
    from packages.adapters.redis.feature_flag_store import (
        FeatureFlagConfig,
        InMemoryFeatureFlagStore,
    )
-    from video_processing.render_engine_resolver import RenderEngineResolver

    store = InMemoryFeatureFlagStore()
    store.set(
@@ -121,11 +125,12 @@ def test_resolver_whitelist_overrides_percentage_0():

 def test_resolver_percentage_0_all_legacy():
    """percentage=0 且无白名单时，全部走 legacy。"""
+    from video_processing.render_engine_resolver import RenderEngineResolver
+
    from packages.adapters.redis.feature_flag_store import (
        FeatureFlagConfig,
        InMemoryFeatureFlagStore,
    )
-    from video_processing.render_engine_resolver import RenderEngineResolver

    store = InMemoryFeatureFlagStore()
    store.set(FeatureFlagConfig(name="render_engine", enabled=True, percentage=0))
@@ -137,11 +142,12 @@ def test_resolver_percentage_0_all_legacy():

 def test_resolver_default_unified_when_flag_off():
    """默认引擎设为 unified 且 flag 关闭时，返回 unified。"""
+    from video_processing.render_engine_resolver import RenderEngineResolver
+
    from packages.adapters.redis.feature_flag_store import (
        FeatureFlagConfig,
        InMemoryFeatureFlagStore,
    )
-    from video_processing.render_engine_resolver import RenderEngineResolver

    store = InMemoryFeatureFlagStore()
    store.set(FeatureFlagConfig(name="render_engine", enabled=False, percentage=0))
@@ -170,11 +176,23 @@ def test_legacy_engine_single_clip_keeps_original_fps():
        # 生成 1 秒 30fps 测试视频（带音频）
        subprocess.run(
            [
-                "ffmpeg", "-y",
-                "-f", "lavfi", "-i", "color=c=red:s=640x360:d=1:r=30",
-                "-f", "lavfi", "-i", "anullsrc=r=44100:cl=stereo:d=1",
-                "-c:v", "libx264", "-pix_fmt", "yuv420p",
-                "-c:a", "aac", "-shortest",
+                "ffmpeg",
+                "-y",
+                "-f",
+                "lavfi",
+                "-i",
+                "color=c=red:s=640x360:d=1:r=30",
+                "-f",
+                "lavfi",
+                "-i",
+                "anullsrc=r=44100:cl=stereo:d=1",
+                "-c:v",
+                "libx264",
+                "-pix_fmt",
+                "yuv420p",
+                "-c:a",
+                "aac",
+                "-shortest",
                str(input_path),
            ],
            check=True,
@@ -222,11 +240,23 @@ def test_legacy_engine_two_clips_concat_duration():
            color = "red" if idx == 0 else "blue"
            subprocess.run(
                [
-                    "ffmpeg", "-y",
-                    "-f", "lavfi", "-i", f"color=c={color}:s=640x360:d=1:r=30",
-                    "-f", "lavfi", "-i", "anullsrc=r=44100:cl=stereo:d=1",
-                    "-c:v", "libx264", "-pix_fmt", "yuv420p",
-                    "-c:a", "aac", "-shortest",
+                    "ffmpeg",
+                    "-y",
+                    "-f",
+                    "lavfi",
+                    "-i",
+                    f"color=c={color}:s=640x360:d=1:r=30",
+                    "-f",
+                    "lavfi",
+                    "-i",
+                    "anullsrc=r=44100:cl=stereo:d=1",
+                    "-c:v",
+                    "libx264",
+                    "-pix_fmt",
+                    "yuv420p",
+                    "-c:a",
+                    "aac",
+                    "-shortest",
                    str(inp),
                ],
                check=True,
@@ -264,11 +294,23 @@ def test_legacy_engine_broll_mode_supported():

        subprocess.run(
            [
-                "ffmpeg", "-y",
-                "-f", "lavfi", "-i", "color=c=green:s=640x360:d=1:r=30",
-                "-f", "lavfi", "-i", "anullsrc=r=44100:cl=stereo:d=1",
-                "-c:v", "libx264", "-pix_fmt", "yuv420p",
-                "-c:a", "aac", "-shortest",
+                "ffmpeg",
+                "-y",
+                "-f",
+                "lavfi",
+                "-i",
+                "color=c=green:s=640x360:d=1:r=30",
+                "-f",
+                "lavfi",
+                "-i",
+                "anullsrc=r=44100:cl=stereo:d=1",
+                "-c:v",
+                "libx264",
+                "-pix_fmt",
+                "yuv420p",
+                "-c:a",
+                "aac",
+                "-shortest",
                str(input_path),
            ],
            check=True,
@@ -276,8 +318,10 @@ def test_legacy_engine_broll_mode_supported():
        )

        clip = _TestClip(
-            asset_id="asset-1", duration=1.0,
-            clip_type="main", config={"role": "b_roll"},
+            asset_id="asset-1",
+            duration=1.0,
+            clip_type="main",
+            config={"role": "b_roll"},
        )
        asset_path_map = {"asset-1": input_path}
Author	SHA1	Message	Date
代码审计	b4890da58c	fix(ci): use triple-quoted strings in gitleaks.toml to avoid quote parsing errors CI/CD Pipeline / Unit Tests (pull_request) Failing after 15s Details CI/CD Pipeline / Frontend Lint (pull_request) Failing after 14s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 17s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 8s Details	2026-07-13 16:56:40 +08:00
代码审计	a141cd56ff	fix(ci): fix gitleaks.toml regex syntax - glob to regex patterns CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 10s Details CI/CD Pipeline / Frontend Lint (pull_request) Failing after 10s Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 18s Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 25s Details	2026-07-13 16:54:20 +08:00
代码审计	90f3c0694c	docs(ci): update security scan briefing with gitleaks fix details + PR264 review CI/CD Pipeline / Unit Tests (pull_request) Failing after 9s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 10s Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 26s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m57s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details	2026-07-13 16:51:46 +08:00
代码审计	10cb082560	fix(ci): add more Chinese mirrors for gitleaks download + graceful degradation CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 9s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 5s Details CI/CD Pipeline / Frontend Lint (pull_request) Failing after 7s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 7s Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details	2026-07-13 16:50:45 +08:00
xiaoxia	cd66aace5b	docs(ci): add first security scan briefing report CI/CD Pipeline / Unit Tests (pull_request) Failing after 16s Details CI/CD Pipeline / Frontend Lint (pull_request) Failing after 17s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 2m37s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 25s Details - Overview of gitleaks, pip-audit, vulture status - Known issues: new runner stuck, black format failure - Next steps and action items	2026-07-13 16:39:44 +08:00
xiaoxia	e9ad12e072	docs(ci): add security scanning roadmap document CI/CD Pipeline / Unit Tests (pull_request) Failing after 18s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m47s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 21m53s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 16s Details - Phase 0: baseline (bandit, black, isort, flake8) - existing - Phase 1: security foundation (gitleaks P0, pip-audit P1) - in progress - Phase 2: quality & frontend (npm audit P1, vulture P2) - planned - Phase 3: deep quality (mypy, semgrep, dep auto-update) - future - Access principles, progress tracking table	2026-07-13 16:26:26 +08:00
xiaoxia	e557da4d98	fix(ci): add Chinese mirror for gitleaks download CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 2m12s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 3m5s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 24s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 21m1s Details - Gitea runner servers cannot reach GitHub directly (connection timeout) - Add ghproxy mirror as primary download source - Add multiple fallback URLs for reliability - Fix pip-audit exit code handling - Improve error messages	2026-07-13 16:25:06 +08:00
xiaoxia	cef402f88d	ci: integrate gitleaks and pip-audit into validate job CI/CD Pipeline / Integration Tests (pull_request) Failing after 29s Details CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 2m15s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 40s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m59s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details - Add gitleaks secret detection step (P0 - blocking) - PR mode: incremental scan (only changed files) - Push mode: full repository scan - Block merge if secrets detected - Add pip-audit dependency vulnerability scan (P1 - advisory) - Scan all requirements files - Advisory mode only, no blocking - Steps placed early in validate job for fast feedback	2026-07-13 15:12:15 +08:00
xiaoxia	c29297a032	ci: add gitleaks allowlist configuration - Exclude env examples, test files, docs, node_modules, site-packages - Add regex patterns for common placeholder values - Exclude generated lock files and CI config	2026-07-13 15:11:55 +08:00
xiaoxia	cc47c9f90f	chore(frontend): Phase 1 技术债务清理 CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 28s Details CI/CD Pipeline / Unit Tests (push) Failing after 32s Details CI/CD Pipeline / Integration Tests (push) Failing after 24s Details CI/CD Pipeline / Frontend Lint (push) Successful in 2m53s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (push) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (push) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (push) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (push) Has been skipped Details CI/CD Pipeline / Deploy Production (push) Has been skipped Details CI/CD Pipeline / Production Browser E2E (push) Has been skipped Details Merge PR #251: chore(frontend): Phase 1 技术债务清理 - 删除死代码和重复样式 into develop	2026-07-13 15:06:45 +08:00
xiaoxia	c1e466f9c1	fix(backend): Phase 1 后端代码清理与修复 CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 25s Details CI/CD Pipeline / Unit Tests (push) Failing after 26s Details CI/CD Pipeline / Integration Tests (push) Failing after 25s Details CI/CD Pipeline / Frontend Lint (push) Successful in 2m44s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (push) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (push) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (push) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (push) Has been skipped Details CI/CD Pipeline / Deploy Production (push) Has been skipped Details CI/CD Pipeline / Production Browser E2E (push) Has been skipped Details Merge PR #249: fix(backend): Phase 1 后端代码清理与修复 into develop	2026-07-13 15:02:13 +08:00
CI Bot	8598638e8f	fix: 恢复 tts_job/workflow.py 中误删的 TTSJobStatus import CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 45s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 49s Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 43s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m56s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details - 第 207 行仍在使用 TTSJobStatus.COMPLETED.value - 删除 import 会导致运行时 NameError - pyflakes 验证零 undefined name 错误	2026-07-13 14:30:31 +08:00
xiaoxia	c48ddeef7d	fix: black/isort 格式化修复 - generation.py 和单测文件 (#250 ) CI/CD Pipeline / Validate Code Quality And Tests (push) Successful in 1m27s Details CI/CD Pipeline / Unit Tests (push) Successful in 2m12s Details CI/CD Pipeline / Integration Tests (push) Successful in 3m23s Details CI/CD Pipeline / Frontend Lint (push) Successful in 3m27s Details CI/CD Pipeline / Build Production Runtime Images (push) Has been skipped Details CI/CD Pipeline / Deploy Production (push) Has been skipped Details CI/CD Pipeline / Production Browser E2E (push) Has been skipped Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (push) Failing after 5s Details CI/CD Pipeline / Staging E2E Tests (push) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (push) Has been skipped Details	2026-07-13 14:13:45 +08:00
CI Test	b87d7b763e	chore(frontend): Phase 1 技术债务清理 - 删除死代码和重复样式 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 58s Details CI/CD Pipeline / Unit Tests (pull_request) Successful in 2m7s Details CI/CD Pipeline / Integration Tests (pull_request) Successful in 3m47s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 5m5s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details - 删除 src/config/navigation.tsx（废弃文件，211行） - 删除 src/components/business/business.css（死CSS，365行） - 删除 src/api/dashboard.ts（废弃API模块，42行） - 移除 router/index.tsx 重复 my-voices 路由（7行） - 清理 generate.css 重复按钮样式（48行，改用 ui.css 统一样式） - 清理 Admin.css 重复 .xx-card/.xx-select 定义（40行）共减少约 713 行代码，vite build 验证通过	2026-07-13 14:12:00 +08:00
CI Bot	9c6c477f55	fix(backend): Phase 1 后端代码清理与修复 CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 2m22s Details CI/CD Pipeline / Unit Tests (pull_request) Failing after 2m24s Details CI/CD Pipeline / Integration Tests (pull_request) Failing after 37s Details CI/CD Pipeline / Frontend Lint (pull_request) Successful in 4m3s Details CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped Details CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped Details CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped Details CI/CD Pipeline / Deploy Production (pull_request) Has been skipped Details CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped Details CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped Details P0 关键修复: - P0-1: 注册接口添加 RateLimitMiddleware 限流保护 - P0-3: /metrics 端点添加 JWT 认证（移除匿名访问） - P0-4: 修复 Celery 任务名冲突（generation_task vs generate_video） - P1-5: JWT logout token 黑名单机制 P1 修复: - P1-1: forgot_password 硬编码 localhost → 使用 settings.APP_BASE_URL - P1-2: generation.py 直接创建 DB 连接 → 使用依赖注入 - P1-6: Image.open() 未关闭 → 统一使用 with 语句 - P1-7: 订阅续费事务修复 P2 代码质量: - P2-1: 修复 EditingMode 枚举重复定义 → 统一引用 shared 包 - P2-2: 修复 SMTP_FRON_NAME → SMTP_FROM_NAME 拼写 - P2-3: UserModel subscription_quota 类型统一为 float - P2-4: .env.production DATABASE_MAX_OVERFLOW 30 → 10 - 清理 15 处 except:pass（保留 2 处有注释说明的） - 禁用 SVG 上传（XSS 风险） - 删除 decode_token_unsafe() 不安全函数 - 简化 /ready 端点 - 删除 8 处死代码、10 个空文件/模块 - 合并 3 对 100% 重复函数 - 对齐 6 个废弃环境变量 v2 修复（代码审查后）: - 修复密码重置路由路径: /password/forgot → /forgot-password, /password/reset → /reset-password（与前端 API 对齐） - 合并 _check_project_access: asset_libraries.py 和 edit_plans.py 中的重复函数统一到 _helpers.py（含空字符串守卫 + 中文错误信息） - 顺手修复: HTTPException 统一从 fastapi 导入（替换 starlette 导入） - OSS_ENDPOINT 拼写修复拆分为单独 PR，本 PR 不包含	2026-07-13 13:50:52 +08:00
				`@@ -1 +0,0 @@`
				`"""Adapters package for external implementations."""`