From 0466deb9b7d40b9b8577a71cb5bc4b997d547628 Mon Sep 17 00:00:00 2001 From: zhaoxi Date: Fri, 1 May 2026 01:41:37 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E4=BA=86=E9=83=A8?= =?UTF-8?q?=E5=88=86=E9=94=99=E8=AF=AF=201..env=E6=9B=B4=E5=90=8D=E4=B8=BA?= =?UTF-8?q?.env.template=EF=BC=8C=202.=20pretor/utils/access.py=20?= =?UTF-8?q?=E5=92=8C=20main.py=20=E5=AF=B9=E4=BA=8Esecret=5Fkey=E7=9A=84?= =?UTF-8?q?=E9=80=BB=E8=BE=91=E8=BF=9B=E8=A1=8C=E4=BC=98=E5=8C=96=EF=BC=8C?= =?UTF-8?q?=E5=A6=82=E6=9E=9C=E5=AF=86=E9=92=A5=E4=B8=BA=E9=BB=98=E8=AE=A4?= =?UTF-8?q?=E5=AF=86=E9=92=A5=E4=BC=9A=E5=BC=BA=E8=A1=8C=E7=94=9F=E6=88=90?= =?UTF-8?q?=E4=B8=80=E4=B8=AA=E5=AE=89=E5=85=A8=E7=9A=84=E5=AF=86=E9=92=A5?= =?UTF-8?q?.=203.pretor/api/platform/frontend.py=20=E7=9A=84=20upload=5Ffi?= =?UTF-8?q?le=E5=87=BD=E6=95=B0=E6=94=B9=E4=B8=BA=E4=BA=86=E5=BC=82?= =?UTF-8?q?=E6=AD=A5=E8=AF=BB=E5=86=99?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .dockerignore | 2 +- .env => .env.template | 0 main.py | 9 +++++++-- pretor/api/platform/frontend.py | 10 ++++++---- pretor/utils/access.py | 3 +++ 5 files changed, 17 insertions(+), 7 deletions(-) rename .env => .env.template (100%) diff --git a/.dockerignore b/.dockerignore index e11a476..acf91de 100644 --- a/.dockerignore +++ b/.dockerignore @@ -6,6 +6,6 @@ __pycache__ frontend/node_modules frontend/dist docker-compose.yml -.env +.env.template .env.example .idea \ No newline at end of file diff --git a/.env b/.env.template similarity index 100% rename from .env rename to .env.template diff --git a/main.py b/main.py index 8494a91..a1a55bd 100644 --- a/main.py +++ b/main.py @@ -11,8 +11,13 @@ from pretor.core.workflow.workflow_runner import WorkflowRunningEngine from pretor.core.api import PretorGateway from ray import serve import os +import secrets - +_secret_key = os.getenv("SECRET_KEY") +if not _secret_key or _secret_key in {"secret", "114514"}: + _secret_key = secrets.token_urlsafe(32) + os.environ["SECRET_KEY"] = _secret_key + print("⚠️ 警告: 未提供有效的 SECRET_KEY 或使用了不安全的默认值，已生成并设置随机密钥。") async def start_system(): env_vars = { @@ -21,7 +26,7 @@ async def start_system(): "POSTGRES_HOST": os.getenv("POSTGRES_HOST", "db"), "POSTGRES_PORT": os.getenv("POSTGRES_PORT", "5432"), "POSTGRES_DB": os.getenv("POSTGRES_DB", "postgres"), - "SECRET_KEY": os.getenv("SECRET_KEY", "secret"), + "SECRET_KEY": os.getenv("SECRET_KEY"), } ray.init(ignore_reinit_error=True, diff --git a/pretor/api/platform/frontend.py b/pretor/api/platform/frontend.py index 21a2be2..40cb8e1 100644 --- a/pretor/api/platform/frontend.py +++ b/pretor/api/platform/frontend.py @@ -18,9 +18,10 @@ from pretor.utils.access import Accessor, TokenData from pretor.api.platform.event import PretorEvent from pretor.utils.ray_hook import ray_actor_hook import os -import shutil - +import anyio from pretor.utils.logger import get_logger + + logger = get_logger('frontend') client_router = APIRouter(prefix="/api/v1/adapter/client", tags=["client"]) @@ -54,8 +55,9 @@ async def upload_file(file: UploadFile = File(...), upload_dir = "uploads" os.makedirs(upload_dir, exist_ok=True) file_path = os.path.join(upload_dir, file.filename) - with open(file_path, "wb") as buffer: - shutil.copyfileobj(file.file, buffer) + async with await anyio.open_file(file_path, "wb") as buffer: + while chunk := await file.read(64 * 1024): # 64KB chunks + await buffer.write(chunk) logger.info(f"用户 {token_data.username} 上传了文件: {file.filename}") return {"filename": file.filename, "message": f"File {file.filename} uploaded successfully"} except Exception as e: diff --git a/pretor/utils/access.py b/pretor/utils/access.py index bd5cfef..a33b7aa 100644 --- a/pretor/utils/access.py +++ b/pretor/utils/access.py @@ -31,6 +31,9 @@ SECRET_KEY = os.getenv("SECRET_KEY") ALGORITHM = "HS256" ACCESS_TOKEN_EXPIRE_MINUTES = 60 * 24 +if not SECRET_KEY or SECRET_KEY in {"secret", "114514"}: + raise RuntimeError("未提供有效的 SECRET_KEY 或使用了不安全的默认值") + password_hasher = PasswordHash.recommended()