From 3a6ab7d7564c604e8cea12682d3a8fd05c93041f Mon Sep 17 00:00:00 2001 From: duxingchen Date: Wed, 12 Aug 2026 12:04:40 +0800 Subject: [PATCH] =?UTF-8?q?security:=20=E8=A1=A5=E5=85=A8=E5=89=A9?= =?UTF-8?q?=E4=BD=99=E7=AB=AF=E7=82=B9=E9=89=B4=E6=9D=83=20+=20=E7=A7=BB?= =?UTF-8?q?=E9=99=A4=E7=A1=AC=E7=BC=96=E7=A0=81=E7=AE=A1=E7=90=86=E5=91=98?= =?UTF-8?q?=E5=90=8E=E9=97=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. 鉴权补全 - orders.py: create_order 补全 Depends(get_current_user) - print.py: print_execute 和 update_printer_config 补全鉴权 - records.py: update_record 和 delete_record 补全鉴权 2. 安全加固 - auth_service.py: 移除硬编码超级管理员(IRIS/123321)后门 - 所有用户统一通过MOM sys_user scrypt密码验证登录 --- backend/app/api/v1/endpoints/orders.py | 7 ++++++- backend/app/api/v1/endpoints/print.py | 13 ++++++++++--- backend/app/api/v1/endpoints/records.py | 3 +++ backend/app/services/auth_service.py | 20 +++----------------- 4 files changed, 22 insertions(+), 21 deletions(-) diff --git a/backend/app/api/v1/endpoints/orders.py b/backend/app/api/v1/endpoints/orders.py index afc4b5b..57d1410 100644 --- a/backend/app/api/v1/endpoints/orders.py +++ b/backend/app/api/v1/endpoints/orders.py @@ -9,6 +9,7 @@ from sqlalchemy.orm import selectinload from app.core.database import get_db from app.models.production_order import ProductionOrder from app.schemas.order import OrderCreate, OrderResponse +from app.services.auth_service import get_current_user router = APIRouter(prefix="/orders", tags=["订单管理"]) @@ -27,7 +28,11 @@ async def list_orders( @router.post("/", response_model=OrderResponse, status_code=201) -async def create_order(data: OrderCreate, db: AsyncSession = Depends(get_db)): +async def create_order( + data: OrderCreate, + db: AsyncSession = Depends(get_db), + current_user: dict = Depends(get_current_user), +): order = ProductionOrder(**data.model_dump()) db.add(order) await db.commit() diff --git a/backend/app/api/v1/endpoints/print.py b/backend/app/api/v1/endpoints/print.py index c93e069..82a25ab 100644 --- a/backend/app/api/v1/endpoints/print.py +++ b/backend/app/api/v1/endpoints/print.py @@ -1,9 +1,10 @@ """标签打印 API — 预览 / 执行 / 打印机配置""" -from fastapi import APIRouter, HTTPException, status +from fastapi import APIRouter, Depends, HTTPException, status from pydantic import BaseModel, Field from app.services.label_service import generate_preview_image, send_to_printer from app.services.print_config import PrintConfigManager +from app.services.auth_service import get_current_user router = APIRouter(prefix="/print", tags=["标签打印"]) @@ -49,7 +50,10 @@ def print_preview(data: LabelPreviewRequest) -> dict: @router.post("/execute") -def print_execute(data: PrintExecuteRequest) -> dict: +def print_execute( + data: PrintExecuteRequest, + current_user: dict = Depends(get_current_user), +) -> dict: """发送打印指令到物理打标机""" payload = data.model_dump() copies = payload.pop("copies", 1) @@ -77,7 +81,10 @@ def get_printer_config() -> dict: @router.post("/config") -def update_printer_config(data: PrinterConfigUpdate) -> dict: +def update_printer_config( + data: PrinterConfigUpdate, + current_user: dict = Depends(get_current_user), +) -> dict: """更新打印机配置（IP/端口）""" current = PrintConfigManager.get_config() current["label_printer"] = { diff --git a/backend/app/api/v1/endpoints/records.py b/backend/app/api/v1/endpoints/records.py index 38eb511..8ac7531 100644 --- a/backend/app/api/v1/endpoints/records.py +++ b/backend/app/api/v1/endpoints/records.py @@ -8,6 +8,7 @@ from sqlalchemy.ext.asyncio import AsyncSession from app.core.database import get_db from app.models.task import TaskRecord from app.schemas.task import TaskRecordCreate, TaskRecordResponse +from app.services.auth_service import get_current_user router = APIRouter(prefix="/records", tags=["任务记录"]) @@ -25,6 +26,7 @@ async def update_record( record_id: int, data: TaskRecordCreate, db: AsyncSession = Depends(get_db), + current_user: dict = Depends(get_current_user), ): """更新任务记录（备注+图片）""" record = await _get_record_or_404(db, record_id) @@ -40,6 +42,7 @@ async def update_record( async def delete_record( record_id: int, db: AsyncSession = Depends(get_db), + current_user: dict = Depends(get_current_user), ): """删除任务记录""" record = await _get_record_or_404(db, record_id) diff --git a/backend/app/services/auth_service.py b/backend/app/services/auth_service.py index 606785e..170d614 100644 --- a/backend/app/services/auth_service.py +++ b/backend/app/services/auth_service.py @@ -23,21 +23,7 @@ def login(username: str, password: str) -> LoginResponse: """登录 — 签发双 Token（Access + Refresh）""" db = MomSessionLocal() try: - # 1. 超级管理员硬编码（和 MOM 系统一致） - if username == "IRIS" and password == "123321": - token_data = {"sub": "0", "role": "SUPER_ADMIN", "username": "IRIS", "display_name": "超级管理员"} - return LoginResponse( - access_token=create_access_token(data=token_data), - refresh_token=create_refresh_token(data=token_data), - user=UserResponse( - id="0", - username="IRIS", - display_name="超级管理员", - role="SUPER_ADMIN", - ), - ) - - # 2. 普通用户：LIKE '%/username' 模糊匹配 MOM sys_user 表 + # 1. 普通用户：LIKE '%/username' 模糊匹配 MOM sys_user 表 from sqlalchemy import text result = db.execute( text( @@ -57,14 +43,14 @@ def login(username: str, password: str) -> LoginResponse: user_id, full_username, department, role, password_hash = row - # 3. Werkzeug scrypt 密码验证 + # 2. Werkzeug scrypt 密码验证 if not check_password_hash(password_hash, password): raise HTTPException( status_code=status.HTTP_401_UNAUTHORIZED, detail="用户名或密码错误", ) - # 4. 解析 display_name（"张三/zhangsan01" → "张三"） + # 3. 解析 display_name（"张三/zhangsan01" → "张三"） display_name = full_username.split("/")[0] if "/" in full_username else full_username token_data = {