大量优化

image_moderation.py

@@ -198,7 +198,7 @@ async def moderate_image_tencent(image_content: bytes) -> ModerationResult:
         response = result.get("Response", {})
         
         if "Error" in response:
-            logger.error(f"腾讯云审核API错误: {response['Error']}")
+            logger.error(f"腾讯云审核API错误: {response.get('Error', 'unknown')!r}")
             return ModerationResult(passed=True, suggestion="pass", 
                                    details={"error": response["Error"]})
         
@@ -220,7 +220,7 @@ async def moderate_image_tencent(image_content: bytes) -> ModerationResult:
         )
         
     except Exception as e:
-        logger.error(f"腾讯云审核异常: {str(e)}")
+        logger.error(f"腾讯云审核异常: {e!r}")
         # 审核服务异常时拒绝，需要人工审核
         return ModerationResult(passed=False, suggestion="review",
                                details={"error": "审核服务暂时不可用，需人工审核"})

rate_limiter.py

@@ -167,9 +167,18 @@ def record_request(ip: str, endpoint: str):
     now = time.time()
     key = f"{ip}:{endpoint}"
     
-    # 超出字典上限时触发清理
+    # 🔒 P0安全加固：主动清理机制，防止短期内 OOM
     if len(ip_stats) >= MAX_DICT_SIZE:
-        cleanup_expired_entries()
+        # 第一步：清理过期条目（超过1小时未活跃的）
+        expired_keys = [k for k, v in list(ip_stats.items()) if now - v.get("last_request", 0) > 3600]
+        for k in expired_keys:
+            del ip_stats[k]
+        # 第二步：如果清理后仍超限，删除最老的 20%
+        if len(ip_stats) >= MAX_DICT_SIZE:
+            sorted_keys = sorted(ip_stats.keys(), key=lambda k: ip_stats[k].get("last_request", 0))
+            for k in sorted_keys[:len(ip_stats) // 5]:
+                del ip_stats[k]
+            logger.warning(f"IP_STATS_EVICTION | evicted={len(sorted_keys[:len(ip_stats) // 5])}, remaining={len(ip_stats)}")
     
     if key not in ip_stats:
         ip_stats[key] = {"count": 0, "first_request": now}

router_comments.py

@@ -13,26 +13,48 @@ router = APIRouter()
 @router.post("/api/interactions/toggle")
 async def toggle_interaction(interaction: InteractionToggle, current_user: str = Depends(require_auth)):
     interaction.user_id = current_user  # 强制使用当前用户身份，防止伪造
-    items_db = db.load_data("items.json", default_data=[])
-    target_item = next((item for item in items_db if item["id"] == interaction.item_id), None)
-    if not target_item: raise HTTPException(status_code=404, detail="目标存在问题")
-
+    
     list_key = f"{interaction.action_type}d_by" 
     count_key = "likes" if interaction.action_type == "like" else "favorites"
-    if list_key not in target_item: target_item[list_key] = []; target_item[count_key] = 0
-
-    user_list = target_item[list_key]
+    
+    # 使用闭包容器传递原子操作结果
+    result_container = {}
+    
+    def updater(items_db):
+        target_item = next((item for item in items_db if item["id"] == interaction.item_id), None)
+        if not target_item:
+            result_container["error"] = "目标存在问题"
+            return
+        
+        if list_key not in target_item:
+            target_item[list_key] = []
+        
+        user_list = target_item[list_key]
+        if interaction.is_active:
+            # 双重检查：防止并发重复添加
+            if interaction.user_id not in user_list:
+                user_list.append(interaction.user_id)
+        else:
+            if interaction.user_id in user_list:
+                user_list.remove(interaction.user_id)
+        
+        # 基于实际列表长度计算 count，即使并发重复也不会导致数量错误
+        target_item[count_key] = len(target_item[list_key])
+        result_container["count"] = target_item[count_key]
+        result_container["author"] = target_item.get("author", "")
+        result_container["item_id"] = target_item["id"]
+        result_container["title"] = target_item.get("title", "")
+    
+    db.atomic_update("items.json", updater, default_data=[])
+    
+    if result_container.get("error"):
+        raise HTTPException(status_code=404, detail=result_container["error"])
+    
+    # 通知在原子操作外发送（通知失败不影响主流程）
     if interaction.is_active:
-        if interaction.user_id not in user_list: 
-            user_list.append(interaction.user_id)
-            target_item[count_key] += 1
-            add_notification(target_item.get("author", ""), {"type": interaction.action_type, "from_user": interaction.user_id, "target_item_id": target_item["id"], "target_item_title": target_item["title"]})
-    else:
-        if interaction.user_id in user_list: 
-            user_list.remove(interaction.user_id)
-            target_item[count_key] = max(0, target_item[count_key] - 1)
-    db.save_data("items.json", items_db)
-    return {"status": "success", "new_count": target_item[count_key]}
+        add_notification(result_container.get("author", ""), {"type": interaction.action_type, "from_user": interaction.user_id, "target_item_id": result_container["item_id"], "target_item_title": result_container["title"]})
+    
+    return {"status": "success", "new_count": result_container["count"]}
 
 @router.post("/api/comments")
 async def post_comment(comment: CommentCreate, current_user: str = Depends(require_auth)):

router_items.py

@@ -312,7 +312,9 @@ async def get_creator_details(account: str):
     }
 
 @router.post("/api/items")
-async def create_item(item: ItemCreate):
+async def create_item(item: ItemCreate, current_user: str = Depends(require_auth)):
+    # 🔒 P0安全修复：使用 JWT 认证的用户账号作为作者，防止伪造
+    item.author = current_user
     if not item.type:
         raise HTTPException(status_code=400, detail="资源类型不能为空")
     item.price = int(item.price or 0)

router_messages.py

@@ -152,6 +152,12 @@ async def run_admin_script(req: AdminScriptRequest, current_user: str = Depends(
 @router.post("/api/messages/private")
 async def send_private_message(msg: PrivateMessage, current_user: str = Depends(require_auth)):
     msg.sender = current_user  # 强制发送者身份，防止伪造
+    
+    # 验证接收者存在
+    users_db = db.load_data("users.json", default_data={})
+    if msg.receiver not in users_db:
+        raise HTTPException(status_code=404, detail="接收者不存在")
+    
     chats_db = db.load_data("chats.json", default_data={})
     conv_id = f"{min(msg.sender, msg.receiver)}_{max(msg.sender, msg.receiver)}"
     if conv_id not in chats_db: chats_db[conv_id] = []

router_tasks.py

@@ -205,9 +205,14 @@ def check_and_update_expired_tasks(tasks_db, db_session=None):
             logger.info(f"TASK_EXPIRED_JSON_SAVED | tasks={len(expired_task_indices)}")
             
         except Exception as e:
-            # 💳 P0修复：JSON保存失败，记录warning但不回滚SQL（资金已转移，可后续手动恢复）
-            logger.warning(f"TASK_EXPIRED_JSON_SAVE_FAILED | error={str(e)} | 资金已退款但任务状态未更新，需手动修复")
-            # 不抛出异常，因为SQL事务已经成功，资金已经转移
+            # 💳 P0修复：JSON保存失败，记录告警但不回滚SQL（资金已转移，可后续手动恢复）
+            import traceback
+            traceback.print_exc()
+            task_ids = ",".join(item["task_id"] for item in expired_task_indices)
+            print(f"[CRITICAL-DATA-INCONSISTENCY] task_id={task_ids}, SQL已退款但JSON状态未更新. Error: {e}")
+            logger.critical(f"TASK_EXPIRED_JSON_SAVE_FAILED | [CRITICAL-DATA-INCONSISTENCY] task_ids={task_ids} | SQL已退款但JSON状态未更新 | error={str(e)}")
+            # 不抛出异常 - 资金安全退回是更高优先级
+            # 定时任务会在下次扫描时修正状态不一致
     
     # 发送退款通知（在事务外执行，失败不影响主流程）
     for item in refund_results:
@@ -319,15 +324,24 @@ async def get_task_detail(task_id: str, current_user: str = None):
             publisher_info = user_map.get(task.get("publisher"), {})
             assignee_info = user_map.get(task.get("assignee"), {}) if task.get("assignee") else None
             
-            # 构建申请者列表（带用户信息）
-            applicants_with_info = []
-            for app in task.get("applicants", []):
-                app_user = user_map.get(app.get("account"), {})
-                applicants_with_info.append({
-                    **app,
-                    "name": app_user.get("name", app.get("account")),
-                    "avatar": app_user.get("avatarDataUrl", "")
-                })
+            # 🔒 P0安全修复：仅任务发布者可查看完整申请者信息，其他人只返回申请人数
+            is_publisher = current_user and current_user == task.get("publisher")
+            if is_publisher:
+                # 发布者可查看完整申请者列表（带用户信息）
+                applicants_with_info = []
+                for app in task.get("applicants", []):
+                    app_user = user_map.get(app.get("account"), {})
+                    applicants_with_info.append({
+                        **app,
+                        "name": app_user.get("name", app.get("account")),
+                        "avatar": app_user.get("avatarDataUrl", "")
+                    })
+                applicants_result = applicants_with_info
+                applicant_count = len(task.get("applicants", []))
+            else:
+                # 非发布者仅返回申请人数，不暴露申请者个人信息
+                applicants_result = []
+                applicant_count = len(task.get("applicants", []))
             
             # 👁️ 过滤敏感字段（详情接口保留 liked_by 和 favorited_by，过滤 viewed_by）
             task_data = {k: v for k, v in task.items() if k != "viewed_by"}
@@ -340,7 +354,8 @@ async def get_task_detail(task_id: str, current_user: str = None):
                     "publisher_avatar": publisher_info.get("avatarDataUrl", ""),
                     "assignee_name": assignee_info.get("name") if assignee_info else None,
                     "assignee_avatar": assignee_info.get("avatarDataUrl") if assignee_info else None,
-                    "applicants": applicants_with_info,
+                    "applicants": applicants_result,
+                    "applicant_count": applicant_count,
                     "status_text": TASK_STATUS.get(task.get("status"), "未知")
                 }
             }
@@ -515,6 +530,10 @@ async def cancel_task(task_id: str, current_user: str = Depends(require_auth), d
     取消任务（仅发布者可操作，且仅在 open 状态时可取消）
     💳 P0修复：取消时退还冻结资金
     """
+    # 🔒 P0安全修复：防御性断言，确保 current_user 不为 None
+    if not current_user:
+        raise HTTPException(status_code=401, detail="未认证")
+    
     tasks_db = db.load_data("tasks.json", default_data=[])
     
     for task in tasks_db:
@@ -527,6 +546,11 @@ async def cancel_task(task_id: str, current_user: str = Depends(require_auth), d
             
             # 💳 P0修复：退还冻结资金
             frozen_amount = task.get("frozen_amount", task.get("total_price", 0))
+            
+            # 🔒 P0安全修复：冻结金额负数防护
+            if frozen_amount < 0:
+                raise HTTPException(status_code=400, detail="冻结金额无效，无法退款")
+            
             refund_success = False
             
             if frozen_amount > 0:
@@ -668,6 +692,10 @@ async def assign_task(task_id: str, assignee: str, current_user: str = Depends(r
             
             deposit = task.get("deposit_amount", 0)
             
+            # 🔒 P0安全修复：订金金额负数防护
+            if deposit < 0:
+                raise HTTPException(status_code=400, detail="订金金额无效")
+            
             # 💳 从冻结金额中扣除订金（订金暂时不给接单者，待任务完成后一起给）
             wallet = db_session.query(Wallet).filter(Wallet.account == current_user).with_for_update().first()
             if not wallet or wallet.frozen_balance < deposit:
@@ -788,6 +816,10 @@ async def accept_task(task_id: str, is_accepted: bool, feedback: str = None, cur
             deposit = task.get("deposit_paid", task.get("deposit_amount", 0))  # 优先使用已记录的支付订金
             remaining = total_price - deposit  # 尾款
             
+            # 🔒 P0安全修复：金额有效性校验
+            if total_price < 0 or deposit < 0 or remaining < 0:
+                raise HTTPException(status_code=400, detail="任务金额数据异常，无法完成验收")
+            
             if is_accepted:
                 # 💳 验收通过：支付尾款给接单者
                 # 💳 P0修复：使用事务保护，失败则回滚

router_users_auth.py

@@ -78,8 +78,8 @@ async def send_verify_code(request: Request, req: SendCodeRequest, bg_tasks: Bac
     # 🚀 P1性能优化：每次写入前触发清理过期验证码
     cleanup_expired_codes()
     
-    # 构建缓存键（联系方式_动作类型）
-    cache_key = f"{req.contact}_{req.action_type}"
+    # 🔒 P0安全加固：构建缓存键（联系方式:动作类型），使用冒号分隔符避免与邮箱中的下划线混淆
+    cache_key = f"{req.contact}:{req.action_type}"
     
     # 将验证码存入内存缓存，有效期5分钟
     VERIFY_CODES[cache_key] = {
@@ -111,7 +111,8 @@ async def send_code_api(req: SendCodeRequest):
     
     # 生成6位随机验证码
     code = str(random.randint(100000, 999999))
-    key = f"{req.contact}_{req.action_type}"
+    # 🔒 P0安全加固：使用冒号分隔符防止跨操作重用验证码
+    key = f"{req.contact}:{req.action_type}"
     
     # 存入缓存，有效期5分钟
     VERIFY_CODES[key] = {
@@ -125,7 +126,10 @@ async def send_code_api(req: SendCodeRequest):
             send_email_code(req.contact, code, req.action_type)
             return {"status": "success", "message": "验证码已成功发送至邮箱"}
         except Exception as e:
-            raise HTTPException(status_code=500, detail=f"邮件发送失败: {str(e)}")
+            # 🔒 P0安全修复：仅服务端记录详细错误，不暴露给前端
+            import traceback
+            traceback.print_exc()
+            raise HTTPException(status_code=500, detail="邮件发送失败，请稍后重试")
             
     elif req.contact_type == "phone":
         return {"status": "success", "message": "验证码已成功发送至手机"}
@@ -178,7 +182,7 @@ async def register_user(request: Request, user: UserRegister):
             
     # ========== 第二步：验证码校验（并发安全） ==========
     # 根据注册方式构建缓存键
-    cache_key = f"{user.email}_register" if user.email else f"{user.phone}_register"
+    cache_key = f"{user.email}:register" if user.email else f"{user.phone}:register"
     # 🔒 P0安全修复：验证码一次性使用，并发安全键防止并发重用
     async with _verify_code_lock:
         cached = VERIFY_CODES.pop(cache_key, None)
@@ -346,7 +350,7 @@ async def reset_password(request: Request):
         raise HTTPException(status_code=400, detail="填写的手机号与该账号绑定的手机号不匹配")
 
     # 校验验证码（原子性获取+删除）
-    cache_key = f"{verify_contact}_reset"
+    cache_key = f"{verify_contact}:reset"
     # 🔒 P0安全修复：验证码一次性使用，原子性pop防止并发重用
     cached = VERIFY_CODES.pop(cache_key, None)
     expire_time = cached.get("expires_at", cached.get("expires", 0)) if cached else 0

router_wallet.py

@@ -13,7 +13,7 @@
 from fastapi import APIRouter, Depends, HTTPException, Request
 from fastapi.responses import Response
 from sqlalchemy.orm import Session
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 import time
 import uuid
 import hashlib
@@ -48,6 +48,9 @@ from verify_code_engine import VERIFY_CODES
 
 router = APIRouter()
 
+# 🔒 P0安全修复：充值订单预存映射，回调时通过订单号查找真实账号，不依赖 subject 字段
+PENDING_RECHARGE_ORDERS = {}  # {order_id: {"account": str, "amount": int, "created_at": int}}
+
 # ==========================================
 # 脱敏工具函数
 # ==========================================
@@ -134,6 +137,13 @@ async def create_recharge_order(req: RechargeRequest, current_user: str = Depend
     order_id = f"PAY_{uuid.uuid4().hex}"
     subject = f"ComfyUI Community Points - {authenticated_account}"
     
+    # 🔒 P0安全修复：预存订单号->账号映射，供回调时安全查找
+    PENDING_RECHARGE_ORDERS[order_id] = {
+        "account": authenticated_account,
+        "amount": req.amount,
+        "created_at": int(time.time())
+    }
+    
     order_string = alipay.api_alipay_trade_precreate(
         out_trade_no=order_id,
         total_amount=str(req.amount),
@@ -162,50 +172,92 @@ async def alipay_notify(request: Request, db: Session = Depends(get_db)):
     if data.get("trade_status") in ("TRADE_SUCCESS", "TRADE_FINISHED"):
         order_id = data.get("out_trade_no")
         
+        # 🔒 第一层防御：快速预检查（优化，避免不必要的锁获取）
         existing_tx = db.query(Transaction).filter(Transaction.tx_id == order_id).first()
-        if not existing_tx:
-            amount = int(float(data.get("total_amount", 0)))
-            account = data.get("subject", "").split(" - ")[-1]
+        if existing_tx:
+            return Response(content="success", media_type="text/plain")
+        
+        amount = int(float(data.get("total_amount", 0)))
+        
+        # 🔒 P0安全修复：通过预存订单映射查找真实账号，不依赖 subject 字段提取
+        order_info = PENDING_RECHARGE_ORDERS.get(order_id)
+        if not order_info:
+            logger.warning(f"RECHARGE_ORDER_NOT_FOUND | order={order_id} | subject={data.get('subject', '')}")
+            return Response(content="fail", media_type="text/plain")
+        account = order_info["account"]
+        
+        # 🔒 纵深防御：验证 subject 中的账号与预存映射一致
+        subject_account = data.get("subject", "").split(" - ")[-1] if " - " in data.get("subject", "") else ""
+        if subject_account and subject_account != account:
+            logger.warning(f"RECHARGE_ACCOUNT_MISMATCH | order={order_id} | expected={account} | subject={subject_account}")
+            return Response(content="fail", media_type="text/plain")
+        
+        # 清理已处理的预存订单
+        PENDING_RECHARGE_ORDERS.pop(order_id, None)
+        
+        # 🔒 P0安全修复：充值金额有效性校验
+        if amount <= 0:
+            logger.warning(f"RECHARGE_AMOUNT_INVALID | order={order_id} | amount={amount}")
+            return Response(content="fail", media_type="text/plain")
+        
+        # 🔒 P1并发安全：使用悲观锁+异常处理+事务回滚防止并发充值问题
+        # 🔒 P1 TOCTOU修复：先获取行锁，再在锁内检查重复，确保检查和操作的原子性
+        try:
+            wallet = db.query(Wallet).filter(Wallet.account == account).with_for_update().first()
             
-            # 🔒 P1并发安全：使用悲观锁+异常处理+事务回滚防止并发充值问题
-            try:
-                wallet = db.query(Wallet).filter(Wallet.account == account).with_for_update().first()
-                if not wallet:
-                    wallet = Wallet(account=account, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
-                    db.add(wallet)
-                
-                wallet.balance = int(wallet.balance or 0) + int(amount)
-                
-                last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(Transaction.created_at.desc()).first()
-                prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
-                tx_hash = calculate_tx_hash(order_id, account, "RECHARGE", amount, prev_hash)
-                
-                new_tx = Transaction(
-                    tx_id=order_id, account=account, tx_type="RECHARGE", amount=amount,
-                    prev_hash=prev_hash, tx_hash=tx_hash,
-                    description="支付宝充值"
-                )
-                db.add(new_tx)
-                db.commit()
-                
-                # 📝 P2优化：充值审计日志
-                logger.info(f"RECHARGE | account={account} | amount={amount} | order={order_id}")
-            except Exception as e:
-                db.rollback()
-                logger.error(f"RECHARGE_ERROR | account={account} | amount={amount} | order={order_id} | error={str(e)}")
-                return Response(content="fail", media_type="text/plain")
+            # 🔒 第二层防御：在持有行锁后再检查是否已处理过此订单（原子性防重复充值）
+            existing_tx = db.query(Transaction).filter(Transaction.tx_id == order_id).first()
+            if existing_tx:
+                db.commit()  # 释放锁
+                return Response(content="success", media_type="text/plain")  # 幂等返回成功
+            
+            if not wallet:
+                wallet = Wallet(account=account, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
+                db.add(wallet)
+            
+            wallet.balance = int(wallet.balance or 0) + int(amount)
+            
+            last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(Transaction.created_at.desc()).first()
+            prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+            tx_hash = calculate_tx_hash(order_id, account, "RECHARGE", amount, prev_hash)
+            
+            new_tx = Transaction(
+                tx_id=order_id, account=account, tx_type="RECHARGE", amount=amount,
+                prev_hash=prev_hash, tx_hash=tx_hash,
+                description="支付宝充值"
+            )
+            db.add(new_tx)
+            db.commit()
+            
+            # 📝 P2优化：充值审计日志
+            logger.info(f"RECHARGE | account={account} | amount={amount} | order={order_id}")
+        except Exception as e:
+            db.rollback()
+            logger.error(f"RECHARGE_ERROR | account={account} | amount={amount} | order={order_id} | error={str(e)}")
+            return Response(content="fail", media_type="text/plain")
             
     return Response(content="success", media_type="text/plain")
 
 @router.get("/api/wallet/check_order/{order_id}")
-async def check_order(order_id: str, account: str = None, current_user: str = Depends(require_auth), db: Session = Depends(get_db)):
+async def check_order(order_id: str, current_user: str = Depends(require_auth), db: Session = Depends(get_db)):
+    # 🔒 P0安全修复：使用认证用户账号，不再接受客户端传入的 account 参数
+    account = current_user
+    
+    # 🔒 纵深防御：优先从预存订单映射查找账号
+    order_info = PENDING_RECHARGE_ORDERS.get(order_id)
+    if order_info:
+        account = order_info["account"]
+        # 验证认证用户与订单所属用户一致
+        if current_user != account:
+            logger.warning(f"CHECK_ORDER_ACCOUNT_MISMATCH | order={order_id} | auth={current_user} | order_account={account}")
+            return {"status": "PENDING"}
     # 防线 1：先查本地数据库（如果 Webhook 成功了，这里就能查到）
     tx = db.query(Transaction).filter(Transaction.tx_id == order_id).first()
     if tx:
         return {"status": "SUCCESS"}
 
     # 防线 2：主动向支付宝发起查单（解决 Hugging Face 收不到回调的绝杀技）
-    if alipay and account:
+    if alipay:
         try:
             # 拿着订单号去问支付宝：这笔钱到底付了没？
             result = alipay.api_alipay_trade_query(out_trade_no=order_id)
@@ -628,14 +680,14 @@ async def withdraw(request: Request, req: WithdrawRequest, current_user: str = D
     if req.amount < 1:
         raise HTTPException(status_code=400, detail="最小提现金额为1积分")
     
-    # 🔒 验证码缓存键格式：{contact}_{action_type}，与 send_code 接口一致
+    # 🔒 验证码缓存键格式：{contact}:{action_type}，与 send_code 接口一致
     # 先通过账号查询用户邮箱或手机号，再用其构建缓存键（不 fallback 到 account）
     users_db = json_db.load_data("users.json", default_data={})
     user_info = users_db.get(req.account, {})
     user_email = user_info.get("email") or user_info.get("phone", "")
     if not user_email:
         raise HTTPException(status_code=400, detail="请先绑定邮箱或手机号")
-    key = f"{user_email}_withdraw"
+    key = f"{user_email}:withdraw"
     code_data = VERIFY_CODES.get(key)
     # 🔒 P0安全修复：统一使用 expires_at 字段，兼容旧版 expires
     expire_time = code_data.get("expires_at", code_data.get("expires", 0)) if code_data else 0
@@ -1191,7 +1243,7 @@ async def get_admin_withdrawals(
     }
 
 class CompleteWithdrawRequest(BaseModel):
-    payment_order_id: str
+    payment_order_id: str = Field(..., min_length=1, max_length=64, description="支付宝/银行打款流水号")
 
 @router.post("/api/admin/withdrawals/{tx_id}/complete")
 async def complete_withdrawal(

数据库连接.py

@@ -71,7 +71,7 @@ os.makedirs(BACKUP_DIR, exist_ok=True)
 CACHE_TTL = {
     "items.json": 120,      # 列表数据 2 分钟
     "tasks.json": 60,       # 任务数据 1 分钟
-    "users.json": 300,      # 用户数据 5 分钟
+    "users.json": 30,       # 🔒 用户数据 30秒（含权限字段 is_admin，缩短 TTL 确保权限变更及时生效）
     "posts.json": 120,      # 帖子数据 2 分钟
     "comments.json": 60,    # 评论数据 1 分钟
     "disputes.json": 60,    # 申诉数据 1 分钟