fix: 鉴权fail-closed + 44端点async→def + Dockerfile锁依赖commit

安全: 移除硬编码默认key fallback(sisi_default_key_change_me)。
API_KEY/SISI_HF_API_KEY均未配置时启动记录error日志,所有受保护
端点返回503拒绝服务,不再接受可猜测的默认key。

性能: 44个async def端点全部改为def(FastAPI线程池)。全文件零await,
纯同步CPU计算跑在async def里会阻塞uvicorn事件循环,单worker下
并发请求互相卡死(与ziwei API同类问题,badbcb4)。

供应链: Dockerfile克隆china-testing/bazi锁定到commit 7150d5b
(2026-07-09 HEAD),上游变更/删库不再影响生产构建。

冒烟测试: 未配置key→503(任意key), 错误key→403, 正确key→200
(/api/qimen/now)。语法/导入均过。

🦊 Generated with Sisi

Dockerfile

@@ -15,8 +15,10 @@ COPY requirements.txt .
 # Install Python dependencies
 RUN pip install --no-cache-dir -r requirements.txt
 
-# Clone the bazi library
-RUN git clone https://github.com/china-testing/bazi.git /app/bazi_lib
+# Clone the bazi library — pinned to a fixed commit (2026-07-09) so upstream
+# changes/deletions can't silently alter or break our production builds
+RUN git clone https://github.com/china-testing/bazi.git /app/bazi_lib \
+    && git -C /app/bazi_lib checkout 7150d5b6fba5e563dd0751b957dc990bb84ab6f0
 
 # Copy all application code
 COPY *.py .

app.py

@@ -59,11 +59,24 @@ logger = logging.getLogger(__name__)
 # Support both naming conventions:
 # - API_KEY: For HuggingFace Space settings (simple, since only one API key)
 # - SISI_HF_API_KEY: For Cloudflare (clear distinction among many API keys)
-API_KEY = os.environ.get("API_KEY") or os.environ.get("SISI_HF_API_KEY") or "sisi_default_key_change_me"
+# Fail closed: no hardcoded fallback — if neither env var is set, all
+# protected endpoints refuse service instead of accepting a default key.
+API_KEY = os.environ.get("API_KEY") or os.environ.get("SISI_HF_API_KEY")
+
+if not API_KEY:
+    logger.error(
+        "🔒 API key is NOT configured (set API_KEY or SISI_HF_API_KEY). "
+        "All protected endpoints will return 503 until a key is set."
+    )
 
 
 def verify_api_key(x_api_key: Optional[str] = Header(None)):
-    """Verify API key from request header"""
+    """Verify API key from request header (fail closed when unconfigured)"""
+    if not API_KEY:
+        raise HTTPException(
+            status_code=503,
+            detail="🔒 API key is not configured on the server. Service unavailable."
+        )
     if x_api_key != API_KEY:
         raise HTTPException(
             status_code=403,
@@ -649,7 +662,7 @@ def health_check():
 
 @app.post("/calculate-bazi")
 @app.post("/api/calculate-bazi")  # Alternative endpoint
-async def calculate_bazi(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
+def calculate_bazi(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
     """
     Calculate BaZi (八字) chart from birth information
 
@@ -727,7 +740,7 @@ async def calculate_bazi(req: BaZiRequest, api_key: str = Depends(verify_api_key
 
 
 @app.post("/calculate-bazi-simple")
-async def calculate_bazi_simple(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
+def calculate_bazi_simple(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
     """
     Simplified BaZi calculation - returns only essential data
 
@@ -769,7 +782,7 @@ async def calculate_bazi_simple(req: BaZiRequest, api_key: str = Depends(verify_
 
 @app.post("/calculate-bazi-complete")
 @app.post("/api/calculate-bazi-complete")  # Alternative endpoint
-async def calculate_bazi_complete(req: BaZiCompleteRequest, api_key: str = Depends(verify_api_key)):
+def calculate_bazi_complete(req: BaZiCompleteRequest, api_key: str = Depends(verify_api_key)):
     """
     Calculate complete BaZi with 大运 (Major Cycles) and 流年 (Yearly Cycles)
 
@@ -869,7 +882,7 @@ async def calculate_bazi_complete(req: BaZiCompleteRequest, api_key: str = Depen
 
 @app.post("/analyze-shensha")
 @app.post("/api/analyze-shensha")  # Alternative endpoint
-async def analyze_shensha(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
+def analyze_shensha(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
     """
     🔮 Analyze Spiritual Forces (神煞分析) - Advanced Feature
 
@@ -1026,7 +1039,7 @@ async def analyze_shensha(req: BaZiRequest, api_key: str = Depends(verify_api_ke
 
 @app.post("/analyze-genju")
 @app.post("/api/analyze-genju")  # Alternative endpoint
-async def analyze_genju(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
+def analyze_genju(req: BaZiRequest, api_key: str = Depends(verify_api_key)):
     """
     🎯 Analyze Life Pattern (格局分析) - Core Premium Feature
 
@@ -1211,7 +1224,7 @@ async def analyze_genju(req: BaZiRequest, api_key: str = Depends(verify_api_key)
 
 @app.post("/analyze-dayun")
 @app.post("/api/analyze-dayun")  # Alternative endpoint
-async def analyze_dayun(req: BaZiCompleteRequest, api_key: str = Depends(verify_api_key)):
+def analyze_dayun(req: BaZiCompleteRequest, api_key: str = Depends(verify_api_key)):
     """
     📅 Analyze Major Cycles (大运分析) - Premium Fortune Prediction
 
@@ -1472,7 +1485,7 @@ async def analyze_dayun(req: BaZiCompleteRequest, api_key: str = Depends(verify_
 
 @app.post("/ai-interpretation")
 @app.post("/api/ai-interpretation")  # Alternative endpoint
-async def ai_interpretation(req: BaZiInterpretationRequest, api_key: str = Depends(verify_api_key)):
+def ai_interpretation(req: BaZiInterpretationRequest, api_key: str = Depends(verify_api_key)):
     """
     🤖 AI BaZi Interpretation - Transform Technical Analysis into Natural Language
 
@@ -1751,7 +1764,7 @@ async def ai_interpretation(req: BaZiInterpretationRequest, api_key: str = Depen
 
 @app.post("/monthly-fortune")
 @app.post("/api/monthly-fortune")  # Alternative endpoint
-async def analyze_monthly_fortune_api(req: MonthlyFortuneRequest, api_key: str = Depends(verify_api_key)):
+def analyze_monthly_fortune_api(req: MonthlyFortuneRequest, api_key: str = Depends(verify_api_key)):
     """
     📅 Monthly Fortune Analysis (流月运势分析)
 
@@ -1828,7 +1841,7 @@ async def analyze_monthly_fortune_api(req: MonthlyFortuneRequest, api_key: str =
 
 @app.post("/career-monthly-fortune")
 @app.post("/api/career-monthly-fortune")  # Alternative endpoint
-async def analyze_career_monthly_fortune_api(req: CareerMonthlyFortuneRequest, api_key: str = Depends(verify_api_key)):
+def analyze_career_monthly_fortune_api(req: CareerMonthlyFortuneRequest, api_key: str = Depends(verify_api_key)):
     """
     💼 Career-Specific Monthly Fortune Analysis (事业月运分析)
 
@@ -1898,7 +1911,7 @@ async def analyze_career_monthly_fortune_api(req: CareerMonthlyFortuneRequest, a
 
 @app.post("/yearly-fortune")
 @app.post("/api/yearly-fortune")  # Alternative endpoint
-async def analyze_yearly_fortune_api(req: YearlyFortuneRequest, api_key: str = Depends(verify_api_key)):
+def analyze_yearly_fortune_api(req: YearlyFortuneRequest, api_key: str = Depends(verify_api_key)):
     """
     🎯 Yearly Fortune Analysis - 12 Month Complete Forecast (流年12个月运势)
 
@@ -2025,7 +2038,7 @@ async def analyze_yearly_fortune_api(req: YearlyFortuneRequest, api_key: str = D
 
 @app.post("/daily-fortune")
 @app.post("/api/daily-fortune")  # Alternative endpoint
-async def analyze_daily_fortune_api(req: DailyFortuneRequest, api_key: str = Depends(verify_api_key)):
+def analyze_daily_fortune_api(req: DailyFortuneRequest, api_key: str = Depends(verify_api_key)):
     """
     🗓️ Daily Fortune & Date Selection (流日择日分析)
 
@@ -2103,7 +2116,7 @@ async def analyze_daily_fortune_api(req: DailyFortuneRequest, api_key: str = Dep
 
 @app.post("/hourly-fortune")
 @app.post("/api/hourly-fortune")  # Alternative endpoint
-async def analyze_hourly_fortune_api(req: DailyFortuneRequest, api_key: str = Depends(verify_api_key)):
+def analyze_hourly_fortune_api(req: DailyFortuneRequest, api_key: str = Depends(verify_api_key)):
     """
     ⏰ Hourly Fortune Analysis (时辰吉凶分析)
 
@@ -2179,7 +2192,7 @@ async def analyze_hourly_fortune_api(req: DailyFortuneRequest, api_key: str = De
 
 @app.post("/find-auspicious-dates")
 @app.post("/api/find-auspicious-dates")  # Alternative endpoint
-async def find_auspicious_dates_api(req: FindAuspiciousDatesRequest, api_key: str = Depends(verify_api_key)):
+def find_auspicious_dates_api(req: FindAuspiciousDatesRequest, api_key: str = Depends(verify_api_key)):
     """
     🔍 Find Auspicious Dates (寻找吉日)
 
@@ -2284,7 +2297,7 @@ async def find_auspicious_dates_api(req: FindAuspiciousDatesRequest, api_key: st
 # ==================== Chinese Calendar API ====================
 
 @app.get("/api/calendar/today")
-async def get_today_calendar():
+def get_today_calendar():
     """
     Get today's Chinese lunar calendar information
 
@@ -2346,7 +2359,7 @@ async def get_today_calendar():
 
 
 @app.get("/api/calendar/range")
-async def get_calendar_range(start: str, end: str):
+def get_calendar_range(start: str, end: str):
     """
     Get Chinese lunar calendar information for a date range
 
@@ -2408,7 +2421,7 @@ async def get_calendar_range(start: str, end: str):
 
 
 @app.get("/api/calendar/{date_str}")
-async def get_calendar_by_date(date_str: str):
+def get_calendar_by_date(date_str: str):
     """
     Get Chinese lunar calendar information for a specific date
 
@@ -2458,7 +2471,7 @@ class LunarToSolarRequest(BaseModel):
 
 
 @app.post("/api/calendar/convert-lunar-to-solar")
-async def convert_lunar_to_solar(request: LunarToSolarRequest):
+def convert_lunar_to_solar(request: LunarToSolarRequest):
     """
     Convert Chinese Lunar calendar date to Gregorian (Solar) calendar date
 
@@ -2544,7 +2557,7 @@ class NineStarsRequest(BaseModel):
 
 
 @app.post("/api/nine-stars/analyze")
-async def analyze_nine_stars(
+def analyze_nine_stars(
     req: NineStarsRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -2649,7 +2662,7 @@ async def analyze_nine_stars(
 
 
 @app.get("/api/nine-stars/today")
-async def get_today_nine_stars(
+def get_today_nine_stars(
     hour: int = 12,
     api_key: str = Depends(verify_api_key)
 ):
@@ -2693,7 +2706,7 @@ class Constellation28Request(BaseModel):
 
 
 @app.post("/api/28-constellations/analyze")
-async def analyze_28_constellations(
+def analyze_28_constellations(
     req: Constellation28Request,
     api_key: str = Depends(verify_api_key)
 ):
@@ -2796,7 +2809,7 @@ async def analyze_28_constellations(
 
 
 @app.get("/api/28-constellations/today")
-async def get_today_constellation(api_key: str = Depends(verify_api_key)):
+def get_today_constellation(api_key: str = Depends(verify_api_key)):
     """
     ⭐ Get today's 28 Lunar Mansions constellation
 
@@ -2829,7 +2842,7 @@ async def get_today_constellation(api_key: str = Depends(verify_api_key)):
 
 
 @app.post("/api/28-constellations/find-auspicious")
-async def find_auspicious_dates(
+def find_auspicious_dates(
     activity: str,
     start_date: str,
     end_date: str,
@@ -2921,7 +2934,7 @@ from zodiac_fortune_service import ZodiacFortuneService
 
 
 @app.get("/api/zodiac-fortune/today/{zodiac}")
-async def get_today_zodiac_fortune(zodiac: str):
+def get_today_zodiac_fortune(zodiac: str):
     """
     🐉 Get today's fortune for a specific zodiac (今日生肖运程)
 
@@ -2971,7 +2984,7 @@ async def get_today_zodiac_fortune(zodiac: str):
 
 
 @app.get("/api/zodiac-fortune/{zodiac}/{date_str}")
-async def get_zodiac_fortune_by_date(zodiac: str, date_str: str):
+def get_zodiac_fortune_by_date(zodiac: str, date_str: str):
     """
     🐉 Get fortune for a specific zodiac on a specific date (指定日期生肖运程)
 
@@ -3014,7 +3027,7 @@ async def get_zodiac_fortune_by_date(zodiac: str, date_str: str):
 
 
 @app.get("/api/zodiac-fortune/all/{date_str}")
-async def get_all_zodiac_fortune(date_str: str):
+def get_all_zodiac_fortune(date_str: str):
     """
     🐉 Get fortune for ALL 12 zodiacs on a specific date (12生肖运程)
 
@@ -3117,7 +3130,7 @@ class MarriageCompatibilityRequest(BaseModel):
 
 @app.post("/api/marriage-compatibility")
 @app.post("/marriage-compatibility")
-async def analyze_marriage_compatibility(
+def analyze_marriage_compatibility(
     req: MarriageCompatibilityRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -3243,7 +3256,7 @@ class FortuneScoreRequest(BaseModel):
 
 @app.post("/api/fortune-score")
 @app.post("/fortune-score")
-async def calculate_comprehensive_fortune_score(
+def calculate_comprehensive_fortune_score(
     req: FortuneScoreRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -3344,7 +3357,7 @@ class RitualRecommendRequest(BaseModel):
 
 @app.get("/rituals")
 @app.get("/api/rituals")  # 备用路由
-async def get_all_rituals(api_key: str = Depends(verify_api_key)):
+def get_all_rituals(api_key: str = Depends(verify_api_key)):
     """
     获取所有能量仪式
 
@@ -3386,7 +3399,7 @@ async def get_all_rituals(api_key: str = Depends(verify_api_key)):
 
 @app.get("/rituals/{ritual_id}")
 @app.get("/api/rituals/{ritual_id}")  # 备用路由
-async def get_ritual_by_id(ritual_id: str, api_key: str = Depends(verify_api_key)):
+def get_ritual_by_id(ritual_id: str, api_key: str = Depends(verify_api_key)):
     """
     获取单个仪式详情
 
@@ -3435,7 +3448,7 @@ async def get_ritual_by_id(ritual_id: str, api_key: str = Depends(verify_api_key
 
 @app.post("/rituals/search")
 @app.post("/api/rituals/search")  # 备用路由
-async def search_rituals(request: RitualSearchRequest, api_key: str = Depends(verify_api_key)):
+def search_rituals(request: RitualSearchRequest, api_key: str = Depends(verify_api_key)):
     """
     搜索仪式
 
@@ -3505,7 +3518,7 @@ async def search_rituals(request: RitualSearchRequest, api_key: str = Depends(ve
 
 @app.get("/rituals/category/{category}")
 @app.get("/api/rituals/category/{category}")  # 备用路由
-async def get_rituals_by_category(category: str, api_key: str = Depends(verify_api_key)):
+def get_rituals_by_category(category: str, api_key: str = Depends(verify_api_key)):
     """
     按类别获取仪式
 
@@ -3549,7 +3562,7 @@ async def get_rituals_by_category(category: str, api_key: str = Depends(verify_a
 
 @app.get("/rituals/moon-phase/current")
 @app.get("/api/rituals/moon-phase/current")  # 备用路由
-async def get_current_moon_phase_rituals(api_key: str = Depends(verify_api_key)):
+def get_current_moon_phase_rituals(api_key: str = Depends(verify_api_key)):
     """
     获取当前月相适合的仪式
 
@@ -3587,7 +3600,7 @@ async def get_current_moon_phase_rituals(api_key: str = Depends(verify_api_key))
 
 @app.post("/rituals/recommend")
 @app.post("/api/rituals/recommend")  # 备用路由
-async def recommend_rituals(request: RitualRecommendRequest, api_key: str = Depends(verify_api_key)):
+def recommend_rituals(request: RitualRecommendRequest, api_key: str = Depends(verify_api_key)):
     """
     个性化仪式推荐
 
@@ -3652,7 +3665,7 @@ async def recommend_rituals(request: RitualRecommendRequest, api_key: str = Depe
 
 @app.get("/rituals/related/{ritual_id}")
 @app.get("/api/rituals/related/{ritual_id}")  # 备用路由
-async def get_related_rituals(ritual_id: str, limit: int = 5, api_key: str = Depends(verify_api_key)):
+def get_related_rituals(ritual_id: str, limit: int = 5, api_key: str = Depends(verify_api_key)):
     """
     获取相关仪式
 
@@ -3697,7 +3710,7 @@ async def get_related_rituals(ritual_id: str, limit: int = 5, api_key: str = Dep
 
 @app.get("/rituals/statistics")
 @app.get("/api/rituals/statistics")  # 备用路由
-async def get_rituals_statistics(api_key: str = Depends(verify_api_key)):
+def get_rituals_statistics(api_key: str = Depends(verify_api_key)):
     """
     获取仪式统计信息
 
@@ -3750,7 +3763,7 @@ class BodyReadingRequest(BaseModel):
 
 @app.post("/analyze-body-reading")
 @app.post("/api/analyze-body-reading")
-async def analyze_body_reading_endpoint(
+def analyze_body_reading_endpoint(
     req: BodyReadingRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -3846,7 +3859,7 @@ class MarriageDestinyRequest(BaseModel):
 
 @app.post("/analyze-marriage-destiny")
 @app.post("/api/analyze-marriage-destiny")
-async def analyze_marriage_destiny(
+def analyze_marriage_destiny(
     req: MarriageDestinyRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -3961,7 +3974,7 @@ class QimenChartRequest(BaseModel):
 
 @app.post("/api/qimen/chart")
 @app.post("/qimen-chart")
-async def calculate_qimen_chart(
+def calculate_qimen_chart(
     req: QimenChartRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -4022,7 +4035,7 @@ async def calculate_qimen_chart(
 
 @app.get("/api/qimen/now")
 @app.get("/qimen-now")
-async def get_qimen_now(
+def get_qimen_now(
     purpose: str = "综合",
     api_key: str = Depends(verify_api_key)
 ):
@@ -4089,7 +4102,7 @@ def _liuyao_response(coins, question, purpose) -> dict:
 
 @app.post("/api/liuyao/divine")
 @app.post("/liuyao-divine")
-async def divine_liuyao(
+def divine_liuyao(
     req: LiuYaoRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -4110,7 +4123,7 @@ async def divine_liuyao(
 
 @app.get("/api/liuyao/now")
 @app.get("/liuyao-now")
-async def get_liuyao_now(
+def get_liuyao_now(
     purpose: str = "综合",
     question: str = "",
     api_key: str = Depends(verify_api_key)
@@ -4144,7 +4157,7 @@ class FengshuiMingGuaRequest(BaseModel):
 
 @app.post("/api/fengshui/home-analysis")
 @app.post("/fengshui-home-analysis")
-async def fengshui_home_analysis(
+def fengshui_home_analysis(
     req: FengshuiHomeRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -4166,7 +4179,7 @@ async def fengshui_home_analysis(
 
 @app.post("/api/fengshui/ming-gua")
 @app.post("/fengshui-ming-gua")
-async def fengshui_ming_gua(
+def fengshui_ming_gua(
     req: FengshuiMingGuaRequest,
     api_key: str = Depends(verify_api_key)
 ):
@@ -4181,7 +4194,7 @@ async def fengshui_ming_gua(
 
 
 @app.get("/api/fengshui/zhai-gua/{facing}")
-async def fengshui_zhai_gua(
+def fengshui_zhai_gua(
     facing: str,
     api_key: str = Depends(verify_api_key)
 ):