修复开发容器启动并加固部署配置

backend/app/api/v1/permission_monitoring.py

@@ -399,11 +399,11 @@ def _is_non_china_ip(ip_location: IpLocation) -> bool:
 
 
 def _classify_security_access_log(log: SecurityAccessLog, ip_location: IpLocation | None = None) -> dict[str, str]:
-    if ip_location and _is_non_china_ip(ip_location):
-        return {"category": "ABNORMAL_IP", "severity": "HIGH"}
     path = (log.path or "").lower()
     if any(marker in path for marker in SENSITIVE_PROBE_MARKERS):
         return {"category": "PROBE", "severity": "CRITICAL"}
+    if ip_location and _is_non_china_ip(ip_location):
+        return {"category": "ABNORMAL_IP", "severity": "HIGH"}
     if log.status_code >= 500:
         return {"category": "SERVER_ERROR", "severity": "HIGH"}
     if log.auth_status == "INVALID_TOKEN":

backend/tests/test_permission_monitoring_api.py

@@ -929,6 +929,41 @@ async def test_security_access_logs_classify_sensitive_path_probe(db_session):
     assert result["items"][0]["severity"] == "CRITICAL"
 
 
+@pytest.mark.asyncio
+async def test_security_access_logs_prioritize_sensitive_probe_over_foreign_ip(db_session, monkeypatch):
+    """敏感路径探测应优先于海外 IP 分类，避免降低风险等级。"""
+    await db_session.execute(text("DELETE FROM security_access_logs"))
+    monkeypatch.setattr(
+        permission_monitoring,
+        "resolve_ip_location",
+        lambda ip: FakeIpInfo("South Holland", "", "", "Netherlands"),
+    )
+    await db_session.execute(
+        text(
+            """
+            INSERT INTO security_access_logs
+                (id, method, path, status_code, elapsed_ms, client_ip, user_agent, auth_status, user_identifier, created_at)
+            VALUES
+                ('00000000-0000-4000-8000-000000000505', 'GET', '/api/.git/config', 404, 0.7,
+                 '45.148.10.95', 'probe-bot/1.0', 'ANONYMOUS', NULL, CURRENT_TIMESTAMP)
+            """
+        )
+    )
+    await db_session.commit()
+
+    result = await permission_monitoring.get_security_access_logs(
+        db=db_session,
+        _=AdminUserStub(),
+        status_min=400,
+        auth_status=None,
+        page=1,
+        page_size=20,
+    )
+
+    assert result["items"][0]["category"] == "PROBE"
+    assert result["items"][0]["severity"] == "CRITICAL"
+
+
 @pytest.mark.asyncio
 async def test_security_access_logs_classify_non_china_ip_as_abnormal(db_session, monkeypatch):
     """安全事件明细应把非中国公网 IP 归类为异常 IP。"""