Upload 94 files

app.py

@@ -1,4 +1,7 @@
 # ⚙️ 后端逻辑/核心服务端.py (Hugging Face Spaces app.py)
+from runtime_log_privacy import install_uvicorn_privacy_filters, route_label
+install_uvicorn_privacy_filters()
+
 from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException, Request
 from rate_limit import shared_limit
 from response_privacy import requires_no_store
@@ -106,7 +109,7 @@ def create_error_response(status_code: int, detail: str, error_type: str = None,
 @app.exception_handler(StarletteHTTPException)
 async def http_exception_handler(request, exc):
     """🚀 P3优化：HTTP 异常处理，返回统一格式"""
-    logger.warning(f"HTTP {exc.status_code} | {request.url.path} | detail_type={type(exc.detail).__name__}")
+    logger.warning(f"HTTP {exc.status_code} | {route_label(request)} | detail_type={type(exc.detail).__name__}")
     
     # 根据状态码确定错误类型
     error_type_map = {
@@ -147,13 +150,7 @@ async def private_response_cache_control(request: Request, call_next):
 @app.exception_handler(RequestValidationError)
 async def validation_exception_handler(request, exc):
     """🚀 P3优化：请求参数校验失败处理"""
-    # Pydantic errors may include rejected input values (passwords, tokens, private text).
-    # Keep only field paths and machine error codes in public runtime logs.
-    error_fields = [
-        {"field": ".".join(str(loc) for loc in err.get("loc", ())[1:]), "type": err.get("type", "unknown")}
-        for err in exc.errors()
-    ]
-    logger.warning(f"Validation Error | {request.url.path} | fields={error_fields}")
+    logger.warning("Validation Error | %s | count=%d", route_label(request), len(exc.errors()))
     
     # 提取简洁的错误信息
     errors = []
@@ -175,7 +172,7 @@ async def validation_exception_handler(request, exc):
 async def global_exception_handler(request, exc):
     """🚀 P3优化：全局异常处理，捕获所有未预期异常"""
     error_id = f"ERR_{int(time.time())}_{id(exc) % 10000}"
-    logger.error(f"Unhandled Exception [{error_id}] | {request.url.path} | error_type={type(exc).__name__}")
+    logger.error(f"Unhandled Exception [{error_id}] | {route_label(request)} | error_type={type(exc).__name__}")
     return JSONResponse(
         status_code=500,
         content=create_error_response(

models.py

@@ -1,7 +1,7 @@
 # models.py
 import re
 from pydantic import BaseModel, Field, field_validator  # 🧹 P2修复：pydantic v2 已废弃 v1 风格 validator
-from typing import Optional, List
+from typing import Optional, List, Literal
 
 def _validate_email_format(email: str) -> str:
     """邮箱格式校验"""
@@ -18,9 +18,9 @@ def _validate_password_length(password: str) -> str:
     return password
 
 class SendCodeRequest(BaseModel):
-    contact: str
-    contact_type: str  
-    action_type: str   
+    contact: str = Field(..., min_length=1, max_length=254)
+    contact_type: Literal["email", "phone"]
+    action_type: Literal["register", "reset", "recover", "withdraw"]
     account: Optional[str] = None  
 
 class UserRegister(BaseModel):

router_users_auth.py

@@ -15,7 +15,7 @@ from rate_limit import shared_limit, store_verification_code, consume_verificati
 import asyncio
 import time
 import re
-import random
+import secrets
 import json
 import logging
 import 数据库连接 as db
@@ -36,6 +36,35 @@ logger = logging.getLogger("ComfyUI-Ranking.UsersAuth")
 router = APIRouter()
 
 
+def _find_contact_account(contact, contact_type):
+    try:
+        users = db.load_data("users.json", default_data={}, strict=True)
+        if not isinstance(users, dict):
+            raise ValueError("invalid_users")
+        for account, user in users.items():
+            if not isinstance(account, str) or not isinstance(user, dict):
+                raise ValueError("invalid_user")
+            if user.get(contact_type) == contact:
+                return account, user
+        return None, None
+    except Exception as error:
+        logger.warning("账号联系方式读取失败: error_type=%s", type(error).__name__)
+        raise HTTPException(status_code=503, detail="用户数据暂不可用") from None
+
+
+async def _check_code_contact(req):
+    if req.action_type == "recover":
+        account, _ = await asyncio.to_thread(_find_contact_account, req.contact, req.contact_type)
+        return account is not None
+    if req.action_type == "reset":
+        if not req.account:
+            raise HTTPException(status_code=400, detail="找回密码需先填写当前账号")
+        user = await asyncio.to_thread(read_user, req.account)
+        if user.get(req.contact_type) != req.contact:
+            raise HTTPException(status_code=400, detail="填写的联系方式与该账号绑定信息不匹配")
+    return True
+
+
 # ==========================================
 # 📤 发送验证码接口（异步后台任务版）
 # ==========================================
@@ -54,38 +83,14 @@ async def send_verify_code(request: Request, req: SendCodeRequest, bg_tasks: Bac
         - action_type: "register" 注册 / "reset" 重置密码 / "recover" 找回账号
         - account: (仅重置密码时必填) 用户账号
     """
-    # 🔎 找回账号：凭绑定邮箱/手机反查，无需账号
-    if req.action_type == "recover":
-        users_db = db.load_data("users.json", default_data={})
-        matched = any(
-            u.get("email") == req.contact or u.get("phone") == req.contact
-            for u in users_db.values()
-        )
-        if not matched:
-            # 🛡️ 防枚举：未注册的联系方式也返回通用成功，但不实际发送验证码
-            return {"status": "success", "message": "如果该联系方式已绑定账号，验证码已发送"}
-
-    # 如果是重置密码，需要先验证账号与联系方式匹配
-    if req.action_type == "reset":
-        if not req.account:
-            raise HTTPException(status_code=400, detail="找回密码需先填写当前账号")
-        
-        users_db = db.load_data("users.json", default_data={})
-        user = users_db.get(req.account)
-        if not user:
-            raise HTTPException(status_code=404, detail="该账号不存在")
-        
-        # 校验联系方式是否与账号绑定的一致
-        if req.contact_type == "email" and user.get("email") != req.contact:
-            raise HTTPException(status_code=400, detail="填写的邮箱与该账号绑定的邮箱不一致")
-        if req.contact_type == "phone" and user.get("phone") != req.contact:
-            raise HTTPException(status_code=400, detail="填写的手机号与该账号绑定的手机号不一致")
+    if not await _check_code_contact(req):
+        return {"status": "success", "message": "如果该联系方式已绑定账号，验证码已发送"}
 
     # 🔒 检查发送频率限制（同一联系方式60秒内只能发送1条）
     check_send_cooldown(req.contact)
     
     # 生成6位随机验证码
-    code = str(random.randint(100000, 999999))
+    code = str(secrets.randbelow(900000) + 100000)
     
     # 🚀 P1性能优化：每次写入前触发清理过期验证码
     cleanup_expired_codes()
@@ -116,32 +121,20 @@ async def send_verify_code(request: Request, req: SendCodeRequest, bg_tasks: Bac
 @shared_limit(5)  # 🔒 安全限流：与异步版对齐，每分钟最多5次
 async def send_code_api(request: Request, req: SendCodeRequest):
     """发送验证码接口（同步版本，直接等待发送结果）"""
-    # 🔎 找回账号：凭绑定邮箱/手机反查，无需账号
-    if req.action_type == "recover":
-        users_db = db.load_data("users.json", default_data={})
-        matched = any(
-            u.get("email") == req.contact or u.get("phone") == req.contact
-            for u in users_db.values()
-        )
-        if not matched:
-            # 🛡️ 防枚举：未注册的联系方式也返回通用成功，但不实际发送验证码
-            return {"status": "success", "message": "如果该联系方式已绑定账号，验证码已发送"}
+    if not await _check_code_contact(req):
+        return {"status": "success", "message": "如果该联系方式已绑定账号，验证码已发送"}
 
     # 🔒 检查发送频率限制（同一联系方式60秒内只能发送1条）
     check_send_cooldown(req.contact)
     
     # 生成6位随机验证码
-    code = str(random.randint(100000, 999999))
+    code = str(secrets.randbelow(900000) + 100000)
     # 🔒 P0安全加固：使用冒号分隔符防止跨操作重用验证码
     key = f"{req.contact}:{req.action_type}"
     
     # 存入缓存，有效期5分钟
     await asyncio.to_thread(store_verification_code, key, code, int(time.time()) + 300)
     
-    # 同步发送（会阻塞等待结果）
-    # ⚡ 性能修复：send_email_code 内部走 SMTP 同步连接（最长可阻塞十秒级），
-    # 直接在 async 处理器里调用会占死唯一的事件循环，导致整个服务期间无法响应任何请求；
-    # 改由 asyncio.to_thread 丢到线程池执行，等待结果的同时不阻塞其他请求。
     if req.contact_type == "email":
         try:
             await asyncio.to_thread(send_email_code, req.contact, code, req.action_type)
@@ -149,10 +142,15 @@ async def send_code_api(request: Request, req: SendCodeRequest):
         except Exception as e:
             # 🔒 P0安全修复：仅服务端记录详细错误，不暴露给前端
             logger.error(f"验证码邮件发送失败: action={req.action_type}, error_type={type(e).__name__}")
-            raise HTTPException(status_code=500, detail="邮件发送失败，请稍后重试")
+            raise HTTPException(status_code=503, detail="邮件发送失败，请稍后重试") from None
             
     elif req.contact_type == "phone":
-        return {"status": "success", "message": "验证码已成功发送至手机"}
+        try:
+            await asyncio.to_thread(send_sms_code, req.contact, code, req.action_type)
+            return {"status": "success", "message": "验证码已成功发送至手机"}
+        except Exception as error:
+            logger.error("验证码短信发送失败: action=%s, error_type=%s", req.action_type, type(error).__name__)
+            raise HTTPException(status_code=503, detail="短信发送失败，请稍后重试") from None
         
     else:
         raise HTTPException(status_code=400, detail="不支持的验证方式")
@@ -187,10 +185,12 @@ async def recover_account(request: Request):
     if not isinstance(data, dict):
         raise HTTPException(status_code=400, detail="请求数据格式异常")
 
-    email = (data.get("email") or data.get("contact") or "").strip()
-    code = (data.get("code") or "").strip()
-
-    if not email or not code:
+    email = data.get("email") or data.get("contact") or ""
+    code = data.get("code") or ""
+    if not isinstance(email, str) or not isinstance(code, str):
+        raise HTTPException(status_code=400, detail="请求参数格式不正确")
+    email, code = email.strip(), code.strip()
+    if not email or len(email) > 254 or not re.fullmatch(r"[0-9]{6}", code):
         raise HTTPException(status_code=400, detail="缺失必要参数 (邮箱/验证码)")
 
     # ========== 第二步：验证码校验（原子性一次性消费，并发安全） ==========
@@ -200,12 +200,7 @@ async def recover_account(request: Request):
         raise HTTPException(status_code=400, detail="验证码不正确或已过期")
 
     # ========== 第三步：按邮箱反查账号 ==========
-    users_db = db.load_data("users.json", default_data={})
-    matched_account = None
-    for account, user in users_db.items():
-        if user.get("email") == email:
-            matched_account = account
-            break
+    matched_account, matched_user = await asyncio.to_thread(_find_contact_account, email, "email")
 
     if not matched_account:
         # 理论上验证码已验证邮箱存在，此处为防御性分支
@@ -215,7 +210,7 @@ async def recover_account(request: Request):
         "status": "success",
         "message": "账号找回成功",
         "account": matched_account,
-        "name": users_db[matched_account].get("name", "")
+        "name": matched_user.get("name", "")
     }
 
 

runtime_log_privacy.py

@@ -0,0 +1,51 @@
+"""运行服务器日志不记录请求目标、客户端标识或异常正文。"""
+import logging
+
+
+def route_label(request):
+    route = request.scope.get('route')
+    label = getattr(route, 'path', None)
+    if (not isinstance(label, str) or len(label) > 256 or not label.startswith('/')
+            or any(char not in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/_{}.-:' for char in label)):
+        return '<unmatched>'
+    return label
+
+
+class UvicornPrivacyFilter(logging.Filter):
+    def filter(self, record):
+        if record.name == 'uvicorn.access':
+            args = record.args
+            method = version = 'unknown'
+            status = 0
+            if isinstance(args, tuple) and len(args) == 5:
+                if type(args[1]) is str and args[1] in {'GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'CONNECT', 'TRACE'}:
+                    method = args[1]
+                if type(args[3]) is str and args[3] in {'1.0', '1.1', '2', '2.0', '3'}:
+                    version = args[3]
+                if type(args[4]) is int and 100 <= args[4] <= 599:
+                    status = args[4]
+            record.msg = '%s - "%s %s HTTP/%s" %d'
+            record.args = ('[client]', method, '[request]', version, status)
+            record.exc_info = record.exc_text = record.stack_info = None
+        elif record.exc_info or record.exc_text or record.stack_info or record.levelno >= logging.ERROR:
+            error = record.exc_info[1] if isinstance(record.exc_info, tuple) and len(record.exc_info) == 3 else None
+            kind = type(error).__name__ if error is not None else 'unknown'
+            if not kind.isidentifier() or len(kind) > 80:
+                kind = 'unknown'
+            record.msg = 'SERVER_ERROR | error_type=%s'
+            record.args = (kind,)
+            record.exc_info = record.exc_text = record.stack_info = None
+        elif record.name == 'uvicorn.error' and type(record.msg) is str and record.msg in {
+            '%s - "WebSocket %s" [accepted]', '%s - "WebSocket %s" 403'
+        }:
+            record.args = ('[client]', '[request]')
+        elif record.name == 'uvicorn.error' and record.levelno < logging.DEBUG:
+            return False
+        return True
+
+
+def install_uvicorn_privacy_filters():
+    for name in ('uvicorn.access', 'uvicorn.error'):
+        logger = logging.getLogger(name)
+        if not any(isinstance(item, UvicornPrivacyFilter) for item in logger.filters):
+            logger.addFilter(UvicornPrivacyFilter())

verify_code_engine.py

@@ -30,8 +30,6 @@ _CLEANUP_INTERVAL = 300  # 5分钟清理一次
 # 🔒 日志脱敏工具
 # ==========================================
 # 作用：HF Spaces 的运行日志对外可见，验证码与联系方式明文入日志等同于泄露账号
-# 关联：云端/本地判据与 数据库连接.py 保持一致（HF Spaces 会注入 SPACE_ID）
-_IS_CLOUD = bool(os.environ.get("SPACE_ID"))
 
 
 def _mask_contact(contact: str) -> str:
@@ -67,12 +65,12 @@ def check_send_cooldown(contact: str):
 
 
 def cleanup_expired_codes():
-    """验证码已存入 SQL；清理由限流模块统一按时间间隔执行。"""
-    global _last_cleanup_time
-    now = time.time()
-    if now - _last_cleanup_time < _CLEANUP_INTERVAL:
-        return
-    _last_cleanup_time = now
+    """验证码已存入 SQL；清理由限流模块统一按时间间隔执行。"""
+    global _last_cleanup_time
+    now = time.time()
+    if now - _last_cleanup_time < _CLEANUP_INTERVAL:
+        return
+    _last_cleanup_time = now
 
 def send_email_code(to_email: str, code: str, action: str):
     """
@@ -91,8 +89,7 @@ def send_email_code(to_email: str, code: str, action: str):
     webhook_url = os.environ.get("MAKE_WEBHOOK_URL")
 
     if not webhook_url:
-        print("警告: 未配置 MAKE_WEBHOOK_URL，跳过邮件发送")
-        return
+        raise RuntimeError("verification_delivery_unavailable")
 
     # 根据动作类型生成不同的邮件标题
     if action == "register":
@@ -133,6 +130,8 @@ def send_email_code(to_email: str, code: str, action: str):
     )
     try:
         with urllib.request.urlopen(req, timeout=10) as response:
+            if not 200 <= response.status < 300:
+                raise RuntimeError("verification_delivery_unconfirmed")
             # 🔒 安全修复：不再打印验证码与邮箱明文（日志对外可见），仅留脱敏标识与动作类型
             print(f"✅ 成功触发 Webhook 发送验证码邮件至 {_mask_contact(to_email)}（动作: {action}）")
     except Exception as e:
@@ -141,6 +140,7 @@ def send_email_code(to_email: str, code: str, action: str):
             status = getattr(e, "code", None)
         status_text = f", status={status}" if isinstance(status, int) and 100 <= status <= 599 else ""
         print(f"❌ Webhook 触发失败: action={action}, target={_mask_contact(to_email)}, error_type={type(e).__name__}{status_text}")
+        raise RuntimeError("verification_delivery_unconfirmed") from None
 
 
 def send_sms_code(phone: str, code: str, action: str):
@@ -175,6 +175,8 @@ def send_sms_code(phone: str, code: str, action: str):
     if twilio_sid:
         token = os.environ.get("TWILIO_TOKEN")
         from_phone = os.environ.get("TWILIO_FROM")
+        if not token or not from_phone:
+            raise RuntimeError("verification_delivery_unavailable")
         
         # 构建短信内容
         body = f"【ComfyUI社区】您正在请求{action_str}，验证码是：{code}，5分钟内有效。"
@@ -188,6 +190,8 @@ def send_sms_code(phone: str, code: str, action: str):
         req.add_header("Authorization", f"Basic {auth}")
         try:
             with urllib.request.urlopen(req, timeout=10) as response:
+                if not 200 <= response.status < 300:
+                    raise RuntimeError("verification_delivery_unconfirmed")
                 print(f"✅ Twilio 短信已成功下发至 {_mask_contact(phone)}")
         except Exception as e:
             status = getattr(getattr(e, "response", None), "status_code", None)
@@ -195,6 +199,7 @@ def send_sms_code(phone: str, code: str, action: str):
                 status = getattr(e, "code", None)
             status_text = f", status={status}" if isinstance(status, int) and 100 <= status <= 599 else ""
             print(f"❌ Twilio 发送失败: target={_mask_contact(phone)}, error_type={type(e).__name__}{status_text}")
+            raise RuntimeError("verification_delivery_unconfirmed") from None
         return
 
     # ==========================================
@@ -210,14 +215,16 @@ def send_sms_code(phone: str, code: str, action: str):
             from alibabacloud_tea_openapi import models as open_api_models
             from alibabacloud_dysmsapi20170525 import models as dysmsapi_models
         except ImportError:
-            print("❌ 缺少阿里云 SDK，请在 requirements.txt 中添加 alibabacloud_dysmsapi20170525")
-            return
+            raise RuntimeError("verification_delivery_unavailable") from None
 
         sk = os.environ.get("ALIYUN_SK")
         sign_name = os.environ.get("ALIYUN_SIGN_NAME")  # 短信签名，如 "阿里云"
         # 根据动作类型选择不同的模板
         tpl_code = os.environ.get("ALIYUN_TPL_REGISTER") if action == "register" else os.environ.get("ALIYUN_TPL_RESET")
 
+        if not sk or not sign_name or not tpl_code:
+            raise RuntimeError("verification_delivery_unavailable")
+
         # 初始化阿里云客户端
         config = open_api_models.Config(access_key_id=aliyun_ak, access_key_secret=sk)
         config.endpoint = 'dysmsapi.aliyuncs.com'
@@ -235,19 +242,11 @@ def send_sms_code(phone: str, code: str, action: str):
             if response.body.code == "OK":
                 print(f"✅ 阿里云短信已成功下发至 {_mask_contact(phone)}")
             else:
-                response_code = getattr(response.body, "code", "unknown")
-                print(f"❌ 阿里云下发失败: target={_mask_contact(phone)}, provider_code={response_code}")
+                print(f"❌ 阿里云下发失败: target={_mask_contact(phone)}")
+                raise RuntimeError("verification_delivery_unconfirmed")
         except Exception as e:
             print(f"❌ 阿里云请求异常: target={_mask_contact(phone)}, error_type={type(e).__name__}")
+            raise RuntimeError("verification_delivery_unconfirmed") from None
         return
 
-    # ==========================================
-    # 降级模式：控制台打印模拟
-    # ==========================================
-    # 作用：当没有配置任何短信服务时，仅在控制台打印验证码（仅限开发测试）
-    # 🔒 P0安全修复：云端日志对外可见，生产环境绝不能打印验证码明文；
-    # 本地开发（无 SPACE_ID）保留原行为，不影响调试便利性。
-    if _IS_CLOUD:
-        print(f"⚠️ 未配置短信密钥，验证码未实际下发（目标: {_mask_contact(phone)}）")
-    else:
-        print(f"⚠️ 未配置短信密钥，模拟下发 -> 手机号: {phone}, 验证码: {code}")
+    raise RuntimeError("verification_delivery_unavailable")