Cheng Zhou
74feca4467
- replace plaintext login and unlock requests with RSA-OAEP/AES-GCM encrypted payloads - add login challenge replay protection, production RSA key validation, and auth tests - wire compose to environment-driven dev/prod settings without committing local secrets - update setup-config smoke scripts and Postman docs for encrypted login - add visit schedule migrations/tests and update study/subject setup workflows
35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
from functools import lru_cache
|
|
from typing import Literal, Optional
|
|
|
|
from pydantic import Field
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
PROTECTED_ADMIN_EMAIL = "admin@huapont.cn"
|
|
PROTECTED_ADMIN_DEFAULT_PASSWORD = "admin123"
|
|
PROTECTED_ADMIN_FULL_NAME = "System Admin"
|
|
PROTECTED_ADMIN_DEPARTMENT = "SYSTEM"
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8", extra="ignore")
|
|
|
|
DATABASE_URL: str = Field(default="postgresql+asyncpg://postgres:postgres@db:5432/ctms")
|
|
ENV: Literal["development", "production", "test"] = "development"
|
|
JWT_SECRET_KEY: str = "dev-secret"
|
|
JWT_EXPIRE_MINUTES: int = 60
|
|
JWT_EXTEND_GRACE_SECONDS: int = 120
|
|
ABSOLUTE_SESSION_MAX_HOURS: int = 8
|
|
LOGIN_RSA_PRIVATE_KEY: Optional[str] = None
|
|
LOGIN_RSA_PUBLIC_KEY: Optional[str] = None
|
|
LOGIN_RSA_KEY_ID: str = "default"
|
|
LOGIN_CHALLENGE_TTL_SECONDS: int = 120
|
|
LOGIN_CHALLENGE_MAX_ACTIVE: int = 1000
|
|
|
|
|
|
@lru_cache
|
|
def get_settings() -> Settings:
|
|
return Settings()
|
|
|
|
|
|
settings = get_settings()
|