Cheng Zhou
1d26646a96
- 新增协作文件夹、文件、不可变修订、成员、会话、回调回执、编辑申请与分享链接数据模型。 - 补齐新建、导入、复制、下载、回收站、恢复、成员授权、所有权转让及文件级权限接口。 - 接入 ONLYOFFICE 共同编辑、历史版本预览与恢复、修订另存副本、导出下载审计和幂等回调保存。 - 增加编辑权限申请、审批通知、项目提醒聚合、通知 Feed、已读处理及历史待办数据回填。 - 支持公开分享的查看或编辑模式、有效期、密码哈希、失败锁定、短时访问凭证与固定分享地址。 - 增加协作者导出、申请编辑、工作表结构保护和所有权管理策略，并纳入项目接口权限矩阵。 - 新增协作文件库、编辑工作区、公开分享页、下载与另存为对话框，以及导航、路由和权限入口。 - 统一网页端与桌面端通知布局，增加沉浸式工作区和浏览器、Tauri 双端全屏能力。 - 扩展运行时文件下载适配、Tauri 环境识别和原生全屏命令，继续保持业务代码运行时边界。 - 加固 ONLYOFFICE 消息桥的同源下载、签名地址隔离和保存为能力校验，并更新桌面发布检查。 - 增加连续数据库迁移、50MB 上传限制、OnlyOffice 中文文案与开发启动路由校验。 - 补充协作、通知、权限、路由、运行时、布局和 OnlyOffice 相关测试及模块说明文档。
101 lines
4.5 KiB
Python
101 lines
4.5 KiB
Python
from functools import lru_cache
|
|
from typing import Literal, Optional
|
|
from urllib.parse import urlsplit
|
|
|
|
from pydantic import Field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
PROTECTED_ADMIN_EMAIL = "admin@huapont.cn"
|
|
PROTECTED_ADMIN_DEFAULT_PASSWORD = "admin123"
|
|
PROTECTED_ADMIN_FULL_NAME = "System Admin"
|
|
PROTECTED_ADMIN_CLINICAL_DEPARTMENT = "SYSTEM"
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
|
|
|
|
DATABASE_URL: str = Field(default="postgresql+asyncpg://postgres:postgres@db:5432/ctms")
|
|
ENV: Literal["development", "production", "test"] = "development"
|
|
JWT_SECRET_KEY: str = "dev-secret"
|
|
JWT_EXPIRE_MINUTES: int = 60
|
|
JWT_EXTEND_GRACE_SECONDS: int = 120
|
|
ABSOLUTE_SESSION_MAX_HOURS: int = 8
|
|
DESKTOP_SESSION_MAX_DAYS: int = 30
|
|
LOGIN_RSA_PRIVATE_KEY: Optional[str] = None
|
|
LOGIN_RSA_PUBLIC_KEY: Optional[str] = None
|
|
LOGIN_RSA_KEY_ID: str = "default"
|
|
LOGIN_CHALLENGE_TTL_SECONDS: int = 120
|
|
LOGIN_CHALLENGE_MAX_ACTIVE: int = 1000
|
|
SETTINGS_ENCRYPTION_KEY: Optional[str] = None
|
|
FRONTEND_PUBLIC_URL: str = "http://localhost:8888"
|
|
CORS_ALLOWED_ORIGINS: str = (
|
|
"http://localhost:8888,http://localhost:5173,"
|
|
"tauri://localhost,http://tauri.localhost"
|
|
)
|
|
IP2REGION_XDB_PATH: Optional[str] = None
|
|
IP2REGION_IPV6_XDB_PATH: Optional[str] = None
|
|
TRUSTED_PROXY_CIDRS: str = "127.0.0.1/32,::1/128,172.16.0.0/12"
|
|
MONITORING_SERVER_PUBLIC_IP: Optional[str] = None
|
|
MONITORING_PUBLIC_IP_DISCOVERY_URLS: str = (
|
|
"https://api64.ipify.org,https://icanhazip.com"
|
|
)
|
|
MONITORING_PUBLIC_IP_DISCOVERY_TIMEOUT_SECONDS: float = Field(default=2.5, ge=0.5, le=10)
|
|
MONITORING_SERVER_LOCATION_CACHE_SECONDS: int = Field(default=86400, ge=300, le=604800)
|
|
MONITORING_IP_GEO_FALLBACK_ENABLED: bool = True
|
|
MONITORING_IP_GEO_FALLBACK_API_KEY: Optional[str] = None
|
|
MONITORING_IP_GEO_FALLBACK_TIMEOUT_SECONDS: float = Field(default=2.5, ge=0.5, le=10)
|
|
MONITORING_IP_GEO_FALLBACK_CACHE_SECONDS: int = Field(default=604800, ge=3600, le=2592000)
|
|
MONITORING_IP_GEO_FALLBACK_MAX_LOOKUPS: int = Field(default=10, ge=1, le=100)
|
|
MONITORING_ACCESS_LOG_RETENTION_DAYS: int = Field(default=90, ge=7, le=3650)
|
|
MONITORING_METRIC_RETENTION_DAYS: int = Field(default=400, ge=30, le=3650)
|
|
MONITORING_RETENTION_INTERVAL_SECONDS: int = Field(default=86400, ge=60, le=604800)
|
|
USER_LOGIN_ACTIVITY_RETENTION_DAYS: int = Field(default=180, ge=30, le=3650)
|
|
USER_SESSION_ONLINE_SECONDS: int = Field(default=300, ge=60, le=3600)
|
|
ONLYOFFICE_ENABLED: bool = False
|
|
ONLYOFFICE_JWT_SECRET: Optional[str] = None
|
|
ONLYOFFICE_INTERNAL_URL: str = "http://onlyoffice"
|
|
ONLYOFFICE_STORAGE_BASE_URL: str = "http://backend:8000"
|
|
ONLYOFFICE_INSTANCE_ID: Optional[str] = None
|
|
ONLYOFFICE_CONFIG_TTL_SECONDS: int = Field(default=300, ge=60, le=900)
|
|
COLLABORATION_MAX_FILE_BYTES: int = Field(default=50 * 1024 * 1024, ge=1024, le=500 * 1024 * 1024)
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
return Settings()
|
|
|
|
|
|
settings = get_settings()
|
|
|
|
|
|
def validate_onlyoffice_configuration() -> None:
|
|
if not settings.ONLYOFFICE_ENABLED:
|
|
return
|
|
secret = (settings.ONLYOFFICE_JWT_SECRET or "").strip()
|
|
instance_id = (settings.ONLYOFFICE_INSTANCE_ID or "").strip()
|
|
if secret == settings.JWT_SECRET_KEY:
|
|
raise RuntimeError("ONLYOFFICE_JWT_SECRET must not reuse JWT_SECRET_KEY")
|
|
if len(secret) < 32:
|
|
raise RuntimeError("ONLYOFFICE_JWT_SECRET must contain at least 32 characters when ONLYOFFICE is enabled")
|
|
if not instance_id:
|
|
raise RuntimeError("ONLYOFFICE_INSTANCE_ID is required when ONLYOFFICE is enabled")
|
|
for name, value in (
|
|
("ONLYOFFICE_INTERNAL_URL", settings.ONLYOFFICE_INTERNAL_URL),
|
|
("ONLYOFFICE_STORAGE_BASE_URL", settings.ONLYOFFICE_STORAGE_BASE_URL),
|
|
):
|
|
parsed = urlsplit(value.strip())
|
|
if parsed.scheme.lower() not in {"http", "https"} or not parsed.hostname:
|
|
raise RuntimeError(f"{name} must be an HTTP(S) URL")
|
|
if parsed.username or parsed.password or parsed.query or parsed.fragment:
|
|
raise RuntimeError(f"{name} must not contain credentials, a query, or a fragment")
|
|
if parsed.path not in {"", "/"}:
|
|
raise RuntimeError(f"{name} must not contain a path")
|
|
|
|
|
|
def get_cors_allowed_origins() -> list[str]:
|
|
return [
|
|
origin.strip()
|
|
for origin in settings.CORS_ALLOWED_ORIGINS.split(",")
|
|
if origin.strip()
|
|
]
|