xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 11 Pull Requests 2 Actions Packages Projects Releases 7 Wiki Activity

fix: 修复后端 8 项审计问题 (P1/P2) #51

Merged
xiaoxia merged 5 commits from fix/audit-backend-p1p2 into develop 2026-06-27 17:20:32 +08:00
Conversation 0 Commits 5 Files Changed 10
+165 -33
xiaoxia commented 2026-06-27 17:05:23 +08:00
Owner
Copy Link
Copy Source

修复的问题

P1 问题

  1. #12 Token 刷新机制缺失 - 实现 refresh token 查找功能，使用 Redis 反向索引
  2. #13 OSS 配置命名统一 - 将 MINIO_* 环境变量统一为 OSS_* 命名
  3. #17 数据库连接池调整 - 将 max_overflow 从 40 调整为 10

P2 问题

  1. #23 storage_key vs file_url 命名混淆 - 添加字段注释明确区分
  2. #24 file_size 类型统一 - 将 Float 改为 Integer 确保精度
  3. #25 硬编码 localhost:3000 - 添加 APP_BASE_URL 配置项
  4. #31 密钥轮换机制 - 添加双密钥支持和轮换指南文档

不需要代码修改

  1. #29 Docker 镜像清理 - 由其他 Agent 处理

修改的文件

  • packages/application/auth/login_use_case.py
  • apps/api/app/api/routes/auth.py
  • apps/api/app/config.py
  • packages/adapters/sqlalchemy_impl/models.py
  • packages/application/auth/register_user_use_case.py
  • packages/application/auth/password_reset_use_case.py
  • .env.production / .env.staging / .env.example
  • docs/KEY-ROTATION.md (新增)
## 修复的问题 ### P1 问题 1. **#12 Token 刷新机制缺失** - 实现 refresh token 查找功能，使用 Redis 反向索引 2. **#13 OSS 配置命名统一** - 将 MINIO_* 环境变量统一为 OSS_* 命名 3. **#17 数据库连接池调整** - 将 max_overflow 从 40 调整为 10 ### P2 问题 4. **#23 storage_key vs file_url 命名混淆** - 添加字段注释明确区分 5. **#24 file_size 类型统一** - 将 Float 改为 Integer 确保精度 6. **#25 硬编码 localhost:3000** - 添加 APP_BASE_URL 配置项 7. **#31 密钥轮换机制** - 添加双密钥支持和轮换指南文档 ### 不需要代码修改 8. **#29 Docker 镜像清理** - 由其他 Agent 处理 ## 修改的文件 - `packages/application/auth/login_use_case.py` - `apps/api/app/api/routes/auth.py` - `apps/api/app/config.py` - `packages/adapters/sqlalchemy_impl/models.py` - `packages/application/auth/register_user_use_case.py` - `packages/application/auth/password_reset_use_case.py` - `.env.production` / `.env.staging` / `.env.example` - `docs/KEY-ROTATION.md` (新增)
xiaoxia added 4 commits 2026-06-27 17:05:23 +08:00
Merge pull request 'fix(web): disable noUnusedLocals/noUnusedParameters' (#7) from develop into main
Deploy / Deploy Staging (push) Successful in 1m33s
Details
Deploy / Build Production Runtime Images (push) Has been skipped
Details
Deploy / Deploy Production (push) Has been skipped
Details
Deploy / Production Browser E2E (push) Has been skipped
Details
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
Details
Tests / test (push) Has been cancelled
Details
Tests / lint (push) Has been cancelled
Details
f510e044dd
Merge pull request 'fix: 统一编辑模式枚举名并删除重复workflow' (#32) from develop into main
Deploy / Deploy Staging (push) Successful in 1m25s
Details
Deploy / Build Production Runtime Images (push) Has been skipped
Details
Deploy / Deploy Production (push) Has been skipped
Details
Deploy / Production Browser E2E (push) Has been skipped
Details
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
Details
e68aa5f759
Merge pull request 'Merge develop to main - Release PR' (#37) from develop into main
Deploy / Deploy Staging (push) Failing after 1m28s
Details
Deploy / Build Production Runtime Images (push) Has been skipped
Details
Deploy / Deploy Production (push) Has been skipped
Details
Deploy / Production Browser E2E (push) Has been skipped
Details
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
Details
c72675a594
Merge pull request 'refactor: sync workspace removal to main' (#40) from develop into main
Auto Merge PRs / auto-merge (push) Failing after 0s
Details
CI/CD Pipeline / Validate Code Quality And Tests (push) Has been cancelled
Details
CI/CD Pipeline / Frontend Lint (push) Has been cancelled
Details
f9675f95df
xiaoxia force-pushed fix/audit-backend-p1p2 from 158b439fe7 to 9d70d5d056 2026-06-27 17:20:25 +08:00 Compare
xiaoxia merged commit f7d109830a into develop 2026-06-27 17:20:32 +08:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#51
Delete Branch "fix/audit-backend-p1p2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?