chenxin
ba502297ac
- 认证：Web Session（__Host- Cookie、HttpOnly/Secure/SameSite=Lax、CSPRNG opaque token 数据库只存哈希）、CSRF 双提交、Origin 校验、dev 登录/登出端点；未认证 401、缺 CSRF 403
- 中间件：Hunjing-Request-ID 回显/生成（request_ UUIDv4）+ W3C traceparent 校验透传；JSON 结构化日志与敏感头脱敏
- 迁移 2：conversation/branch/message/run/idempotency_record 五表（含检查约束与复合索引）；Session 补 token/csrf 哈希列
- 垂直切片：POST /v1/conversations/{id}/messages 按 Idempotency-Key 幂等（同键同体 200 重放、异体 409），同事务原子写 Message+Run+Audit+Outbox+幂等记录；ContentBlock text/markdown 判别联合（未知类型 422）
- SSE：GET /v1/runs/{id}/events 返回快照与终止状态事件 envelope
- 测试 26 项全绿：IDOR 跨域 404 fail-closed、失败注入回滚无孤儿（Run 崩溃后 message/run/audit/outbox/幂等全零）、SSE 事件序、auth 边界；ruff/mypy strict 干净
- 修复真实问题：asyncpg 跨事件循环（anyio/pytest-asyncio 双 loop、模块级 engine 改为 app 实例持有）、httpx 拒存 http 下 Secure Cookie
39 lines
1.1 KiB
Python
39 lines
1.1 KiB
Python
"""FastAPI 应用工厂。"""
|
|
|
|
from fastapi import FastAPI
|
|
|
|
from app.auth.routes import router as auth_router
|
|
from app.conversations.routes import router as conversations_router
|
|
from app.conversations.routes import run_router
|
|
from app.core.config import get_settings
|
|
from app.core.errors import install_error_handlers
|
|
from app.core.middleware import RequestContextMiddleware, configure_logging
|
|
from app.db.session import init_engine
|
|
|
|
|
|
def create_app() -> FastAPI:
|
|
settings = get_settings()
|
|
configure_logging(settings.log_level)
|
|
app = FastAPI(
|
|
title="Hunjing API",
|
|
version="0.1.0",
|
|
# 公共契约位于 docs/contracts 与 openapi/；本服务 docs 仅供开发调试。
|
|
docs_url="/_dev/docs",
|
|
openapi_url="/_dev/openapi.json",
|
|
)
|
|
install_error_handlers(app)
|
|
init_engine(app)
|
|
app.add_middleware(RequestContextMiddleware)
|
|
app.include_router(auth_router)
|
|
app.include_router(conversations_router)
|
|
app.include_router(run_router)
|
|
|
|
@app.get("/healthz", tags=["ops"])
|
|
async def healthz() -> dict[str, str]:
|
|
return {"status": "ok", "env": settings.env}
|
|
|
|
return app
|
|
|
|
|
|
app = create_app()
|