Merge pull request #514 from Marrrrrrrrry/fix/m0-stop-bleeding

工程化加固、安全与性能修复、API 契约统一 snake_case（含 CI 测试流水线）

Author: vastsa

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  # Runtime deps. requirements.txt pins direct deps; requirements.lock.txt is
+  # the hashed, transitive-resolved lockfile. Dependabot raises version PRs
+  # against requirements.txt; regenerate the lockfile in the same PR
+  # (uv pip compile requirements.txt --generate-hashes --universal -o requirements.lock.txt).
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,63 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - master
+      - dev
+  pull_request:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Lint and test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          # The hashed lockfile is the deploy artifact; install from it with
+          # --require-hashes so CI fails on lockfile drift, exactly like the
+          # Docker build does.
+          pip install --require-hashes -r requirements.lock.txt
+          pip install pytest pytest-asyncio httpx
+
+      - name: Ruff
+        run: pipx run ruff==0.16.6 check .
+
+      - name: Verify lockfile matches requirements.txt
+        # Dependabot bumps requirements.txt but cannot regenerate the hashed
+        # lockfile; without this check a stale lockfile would silently keep
+        # the Docker build on old versions.
+        run: |
+          python - <<'PY'
+          import re, sys
+          pins = dict(re.findall(r'^([\w-]+)==([\w.]+)$', open('requirements.txt').read(), re.M))
+          lock = open('requirements.lock.txt').read()
+          stale = []
+          for name, ver in pins.items():
+              m = re.search(rf'(?mi)^{re.escape(name)}==([\w.]+)\b', lock)
+              if m is None or m.group(1) != ver:
+                  stale.append((name, ver, m.group(1) if m else 'ABSENT'))
+          for name, req_ver, lock_ver in stale:
+              print(f'STALE LOCKFILE: {name} requirements.txt={req_ver} lock={lock_ver}')
+          sys.exit(1 if stale else 0)
+          PY
+
+      - name: Run tests
+        run: pytest -q

.gitignore

@@ -80,8 +80,8 @@ docs/_build/
 .pybuilder/
 target/
 *.db
-./filecodebox.db-shm
-./filecodebox.db-wal
+*.db-shm
+*.db-wal
 # Jupyter Notebook
 .ipynb_checkpoints
 
@@ -147,13 +147,8 @@ cython_debug/
 # Project
 .vscode
 .DS_Store
-for_test.py
 .html
-/evaluate/temp.py
-/evaluation/back.json
 data/.env
-.backup/
-/cloc-1.64.exe
 
 # Ignore node_modules
 node_modules/

.pre-commit-config.yaml

@@ -0,0 +1,8 @@
+# First-time setup: pre-commit install
+# Behind a proxy: HTTPS_PROXY=http://<proxy-host>:<port> pre-commit run --all-files
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.16.6
+    hooks:
+      - id: ruff-check
+        args: [--fix]

Dockerfile

@@ -58,11 +58,12 @@ COPY --from=frontend-builder /build/fronted-2024/dist ./themes/2024
 COPY --from=frontend-builder /build/fronted-2023/dist ./themes/2023
 
 # 安装系统安全更新 + Python 依赖
+# 依赖从带哈希的锁定文件安装（--require-hashes），保证构建可复现、防供应链篡改。
 # 清理 apt 缓存，降低镜像噪音与扫描面
 RUN apt-get update \
  && apt-get upgrade -y --no-install-recommends \
  && rm -rf /var/lib/apt/lists/* \
- && pip install --no-cache-dir -r requirements.txt \
+ && pip install --no-cache-dir --require-hashes -r requirements.lock.txt \
  && pip cache purge || true
 
 # 环境变量配置

apps/admin/dependencies.py

@@ -2,7 +2,7 @@
 # @Author  : Lan
 # @File    : depends.py
 # @Software: PyCharm
-from fastapi import Header, HTTPException, Depends
+from fastapi import Header, HTTPException
 from fastapi.requests import Request
 import base64
 import hmac
@@ -27,7 +27,7 @@ def _get_jwt_secret() -> bytes:
 def get_admin_session_expire_seconds() -> int:
     try:
         expires_in = int(
-            getattr(settings, "adminSessionExpire", ADMIN_SESSION_EXPIRE_DEFAULT)
+            getattr(settings, "admin_session_expire", ADMIN_SESSION_EXPIRE_DEFAULT)
         )
     except (TypeError, ValueError):
         return ADMIN_SESSION_EXPIRE_DEFAULT
@@ -155,14 +155,14 @@ async def share_required_login(authorization: str = Header(default=None)):
     """
     验证分享上传权限
     
-    当settings.openUpload为False时，要求用户必须登录并具有管理员权限
-    当settings.openUpload为True时，允许游客上传
+    当 settings.open_upload 为False时，要求用户必须登录并具有管理员权限
+    当 settings.open_upload 为True时，允许游客上传
     
     :param authorization: 认证头信息
     :param request: 请求对象
     :return: 验证结果
     """
-    if not settings.openUpload:
+    if not settings.open_upload:
         if not authorization or not authorization.startswith("Bearer "):
             raise HTTPException(
                 status_code=403, detail="本站未开启游客上传，如需上传请先登录后台"

apps/admin/schemas.py

@@ -39,21 +39,18 @@ class BatchUpdateFileData(BaseModel):
     ids: list[int]
     expired_at: Optional[Union[datetime.datetime, str]] = None
     expired_count: Optional[int] = None
-    clearExpiredAt: Optional[bool] = None
     clear_expired_at: Optional[bool] = None
 
 
 class FilePolicyActionData(BaseModel):
     id: int
     action: str
-    downloadLimit: Optional[int] = None
     download_limit: Optional[int] = None
 
 
 class BatchFilePolicyActionData(BaseModel):
     ids: list[int]
     action: str
-    downloadLimit: Optional[int] = None
     download_limit: Optional[int] = None