member/member-backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): enforce admin allowlist guard on admin APIs and attach bearer for admin client

Browse Source
This commit is contained in:
Chris
2026-03-30 21:25:57 +08:00
parent 0cd863f9c2
commit 0e17997e66
8 changed files with 65 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/core/config.py
View File

@@ -30,6 +30,9 @@ class Settings(BaseSettings):
public_frontend_origins: Annotated[list[str], NoDecode] = ["https://member.ose.tw"]
internal_shared_secret: str = ""
admin_allowlist_emails: Annotated[list[str], NoDecode] = []
admin_allowlist_subs: Annotated[list[str], NoDecode] = []
admin_required_groups: Annotated[list[str], NoDecode] = []
@field_validator("public_frontend_origins", mode="before")
@classmethod
@@ -40,6 +43,15 @@ class Settings(BaseSettings):
return []
return [origin.strip() for origin in value.split(",") if origin.strip()]
@field_validator("admin_allowlist_emails", "admin_allowlist_subs", "admin_required_groups", mode="before")
@classmethod
def parse_csv(cls, value: str | list[str]) -> list[str]:
if isinstance(value, list):
return [str(v).strip() for v in value if str(v).strip()]
if not value:
return []
return [part.strip() for part in value.split(",") if part.strip()]
@property
def database_url(self) -> str:
return (