CI Test
c11e579412
Deploy / Deploy Staging (push) Has been cancelled
Deploy / Build Production Runtime Images (push) Has been cancelled
Deploy / Deploy Production (push) Has been cancelled
Deploy / Production Browser E2E (push) Has been cancelled
CI/CD Pipeline / Frontend Lint (push) Failing after 148h21m51s
CI/CD Pipeline / Validate Code Quality And Tests (push) Failing after 148h21m57s
- ENVIRONMENT=production 时 docs_url/redoc_url/openapi_url 设为 None - 开发/测试环境不受影响
92 lines
3.3 KiB
Python
92 lines
3.3 KiB
Python
import os
|
|
|
|
from app.api.router import api_router, health_router
|
|
from app.config import settings
|
|
from app.middleware.exceptions import (
|
|
APIException,
|
|
api_exception_handler,
|
|
general_exception_handler,
|
|
http_exception_handler,
|
|
validation_exception_handler,
|
|
)
|
|
from app.middleware.logging import RateLimitMiddleware, RequestLoggingMiddleware
|
|
from app.middleware.prometheus_metrics import PrometheusMetricsMiddleware, metrics_endpoint
|
|
from fastapi import FastAPI
|
|
from fastapi.exceptions import RequestValidationError
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
from fastapi.middleware.gzip import GZipMiddleware
|
|
from starlette.exceptions import HTTPException as StarletteHTTPException
|
|
from starlette.staticfiles import StaticFiles
|
|
|
|
app = FastAPI(
|
|
title="小虾 SaaS API",
|
|
description="自动化剪辑 SaaS 平台 API",
|
|
version=settings.APP_VERSION,
|
|
docs_url=None if settings.ENVIRONMENT == "production" else "/docs",
|
|
redoc_url=None if settings.ENVIRONMENT == "production" else "/redoc",
|
|
openapi_url=None if settings.ENVIRONMENT == "production" else "/openapi.json",
|
|
redirect_slashes=False,
|
|
)
|
|
|
|
app.add_exception_handler(APIException, api_exception_handler)
|
|
app.add_exception_handler(StarletteHTTPException, http_exception_handler)
|
|
app.add_exception_handler(RequestValidationError, validation_exception_handler)
|
|
app.add_exception_handler(Exception, general_exception_handler)
|
|
|
|
# P1-1: Fix CORS configuration security issue
|
|
# - allow_credentials=True is incompatible with allow_origins=["*"]
|
|
# - In production, only allow configured domains, not "*"
|
|
if settings.DEBUG:
|
|
allow_origins = settings.CORS_ORIGINS # Allow localhost in debug mode
|
|
else:
|
|
# In production, filter out any wildcard "*" origins
|
|
allow_origins = list({origin for origin in settings.CORS_ORIGINS if origin != "*"})
|
|
# Always ensure production domains are included
|
|
for domain in ("https://xiaoxiajianji.com", "https://saas.xiaoxiajianji.com"):
|
|
if domain not in allow_origins:
|
|
allow_origins.append(domain)
|
|
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=allow_origins,
|
|
allow_credentials=True,
|
|
allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
|
|
allow_headers=["Authorization", "Content-Type"],
|
|
)
|
|
app.add_middleware(GZipMiddleware, minimum_size=1000)
|
|
# P0-1: 登录接口限流 - 每 IP 每分钟最多 10 次登录尝试
|
|
app.add_middleware(RateLimitMiddleware, max_requests=10, window_seconds=60, paths=["/api/v1/auth/login"])
|
|
app.add_middleware(RequestLoggingMiddleware)
|
|
app.add_middleware(PrometheusMetricsMiddleware)
|
|
|
|
app.include_router(health_router)
|
|
app.add_route("/metrics", metrics_endpoint, methods=["GET"])
|
|
app.include_router(api_router)
|
|
|
|
_generated_files_dir = os.getenv("GENERATED_FILES_DIR", "/app/generated")
|
|
os.makedirs(_generated_files_dir, exist_ok=True)
|
|
app.mount(
|
|
os.getenv("GENERATED_FILES_URL_PREFIX", "/generated-files"),
|
|
StaticFiles(directory=_generated_files_dir),
|
|
name="generated-files",
|
|
)
|
|
|
|
|
|
def create_app() -> FastAPI:
|
|
return app
|
|
|
|
|
|
@app.get("/")
|
|
async def root():
|
|
return {
|
|
"service": settings.APP_NAME,
|
|
"status": "running",
|
|
"version": settings.APP_VERSION,
|
|
}
|
|
|
|
|
|
if __name__ == "__main__":
|
|
import uvicorn
|
|
|
|
uvicorn.run(app, host=settings.API_HOST, port=settings.API_PORT)
|