mirror of https://github.com/fastapiadmin/FastapiAdmin.git synced 2026-10-14 05:00:10 +00:00

T

zhangtao 07fa789d2e fix(backend): 安全默认值、异常语义、代码生成注入面与定时任务内置处理器

本批为 t10 → t13 → t15 三轮实现 + 一轮复核驳回整改的最终形态（pytest 83 passed / ruff clean，
已部署并线上验证）。

异常语义
- CustomException 默认状态码 500 → 400（约 433 处裸调用不再被计为服务端故障），
  且「包装底层异常」的 130 处显式恢复 500；get_or_404 → 404；响应体结构不变

代码生成注入面（复核 blocker F1，二次修复）
- column_type 不再做字符串拼接：改为常量白名单派生（类型名 ∈ DB_TO_SQLALCHEMY ∪ {Boolean}，
  长度仅取数字/正则捕获），彻底移除 split("(")[1]
- 列类型加形状白名单；字符串/注释/文档字符串用 \uXXXX，标识符过 safe_ident（含 Python/JS 关键字），
  .vue 文本与静态属性改 HTML 实体
- 落盘闸门由 ast.parse 升级为 assert_python_structure（语法 + 顶层语句白名单 + 与哨兵骨架逐节点比对）
  与 assert_text_structure（.vue/.ts/.toml 行结构）；U+2028/2029 与 C1 控制符纳入转义

安全默认值
- 生产 CORS 不再回落 ["*"]（未配置即拒绝跨域，可选 CORS_STRICT_STARTUP 直接启动失败）
- OAUTH_ALLOWED_HOSTS 不再默认 "*"；新增 ALLOW_LOCALHOST_HOSTS 控制 Host 校验范围
- ALLOWED_HOSTS 收窄为按配置派生；健康检查暴露 code_exec_enabled / cors_origins_configured

定时任务
- SCHEDULER_ALLOW_CODE_EXEC 默认 False；新增 builtin:<模块名>[.<函数名>] 内置处理器路线（不经 exec）
- 判定收敛到 describe_schedulability；列表返回 schedulable / unschedulable_reason；
  启动 reconcile 与状态查询对「已启用但不可调度」打 WARN（去重、恢复后清除）
- 加固：内置处理器必须在本模块内定义或经 HANDLERS 声明，拒绝模块内导入的外部对象（复核 R1）
- 顺带修复：_WARNED_UNSCHEDULABLE 的 set.pop TypeError、job.next_run_time 缺失导致的列表 500

测试：新增 tests/test_generator_template_safety.py、test_security_defaults.py、
test_scheduler_schedulability.py（含恶意载荷、闸门红绿、静态护栏）

2026-10-04 05:12:32 +08:00

.github/workflows

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

backend

fix(backend): 安全默认值、异常语义、代码生成注入面与定时任务内置处理器

2026-10-04 05:12:32 +08:00

docker

docs(env): 补齐密钥与安全相关占位项

2026-10-04 04:26:27 +08:00

frontend

fix(frontend): 修复 5 条 P0（生产构建开关、令牌刷新、上传路径、WS 与开发地址）

2026-10-04 04:33:42 +08:00

.dockerignore

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

.gitignore

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

AUDIT-REPORT.md

docs(audit): 全栈审计报告（7 份分报告 + 总报告）

2026-10-04 04:26:11 +08:00

CHANGELOG.md

docs: 更新贡献指南，补充小程序开发说明

2026-09-06 21:19:58 +08:00

CONTRIBUTING.md

docs: 更新贡献指南，补充小程序开发说明

2026-09-06 21:19:58 +08:00

deploy-artifacts.sh

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

deploy.sh

chore(docker): 调整 dockerignore 排除上传目录

2026-09-07 01:38:38 +08:00

DEPLOYMENT.md

chore(deploy): 成品部署链路、依赖分组与运维基建

2026-10-04 04:26:03 +08:00

LICENSE

chore: 更新项目所有者信息为fastapiadmin

2026-01-18 03:35:38 +08:00

README.en.md

docs(readme): 更新项目说明与界面截图

2026-09-06 20:52:11 +08:00

README.md

docs(readme): 更新项目说明与界面截图

2026-09-06 20:52:11 +08:00

REQUIREMENTS.md

docs: add SaaS multi-tenant platform requirements

2026-09-06 21:19:50 +08:00

SKILL.md

refactor(router): simplify route cache logic, remove nested parent component

2026-09-14 01:06:20 +08:00

README.en.md

FastApiAdmin ^v3.0.0

🚀 Exceptional Code Quality, Production-Ready Admin Dashboard in 5 Minutes

Full-stack rapid development platform powered by FastAPI + Vue3 + TypeScript. Web, H5, and Mini Program — all in one project.

English | 简体中文

🖥️ Screenshots

Web

Mobile (H5 / Mini Program / App from one codebase)

💡 Why FastapiAdmin?

You Need	FastapiAdmin	Django Admin	Frontend-Only
🎯 Ready-to-use admin system	✅	⚠️ Limited	❌ UI only
⚡ FastAPI async high-performance backend	✅	❌ Sync-first	❌ No backend
🔐 RBAC menu/button/data level permissions	✅	❌ Basic	❌
🤖 Code generator (table → full CRUD)	✅	❌	❌
📱 Mobile (H5 + Mini Program) included	✅	❌	❌
🐳 Docker one-click deploy (Nginx + SSL)	✅	❌	❌

👉 Full comparison: Why FastapiAdmin?

🍪 Live Demo

	URL	Account
💻 Web	service.fastapiadmin.com/web	`admin` / `123456`
📱 Mobile	service.fastapiadmin.com/app	`admin` / `123456`
📖 Official Docs	service.fastapiadmin.com	No login

🚀 5-Minute Quick Start

# 1. Clone
git clone https://github.com/fastapiadmin/FastapiAdmin.git

# 2. Configure environments
cp backend/env/.env.example backend/env/.env.dev
cp frontend/web/.env.development.example frontend/web/.env.development

# 3. Start backend (auto-creates tables + seed data on first run)
cd backend && uv sync && uv run main.py run --env=dev

# 4. Start frontend
cd ../frontend/web && pnpm install && pnpm run dev

# ✅ Open http://127.0.0.1:5173, login with admin/123456

Requirements
Python ≥ 3.12	Node.js ≥ 20 + pnpm
MySQL 8.0+ / PostgreSQL 14+	Redis 6.x / 7.x

🐳 Or: One-Command Docker Deployment

cp docker/.env.example docker/.env    # Fill in MySQL / Redis passwords
./deploy.sh                           # Build images and start the full stack (Nginx + SSL included)

For ports, SSL certificates and frontend builds, see the Docker deployment guide.

📦 Structure

FastapiAdmin/            # Monorepo full-stack project
├─ backend/              # FastAPI backend (Pydantic 2.0 + SQLAlchemy + Alembic)
├─ frontend/
│   ├── web/             # Vue3 Web (Element Plus + TypeScript)
│   ├── app/             # UniApp Mobile (H5 + Mini Program + App)
│   └── docs/            # VitePress documentation
├─ docker/               # Docker Compose deploy (Nginx + SSL)
├─ deploy.sh             # One-click deploy script
└─ LICENSE               # MIT

📌 Built-in Features

200+ REST endpoints · MySQL / PostgreSQL / SQLite · SFTP / S3 / OSS / COS / OBS storage adapters · Trim modules with a single ENABLED_MODULES entry

Core Modules (always enabled, cannot be removed)

Module	Capabilities
📊 Dashboard	Workbench, Analytics
⚙️ System Management	Users, Roles, Menus, Departments, Positions, Dicts, Config, Notices, Tickets, Versions
👀 Monitoring	Online users, Server monitoring, Cache monitoring
📝 Logs	Operation audit
🧰 Dev Tools	API Docs

Extension Modules (enabled by default, trim via `ENABLED_MODULES`)

Module	Capabilities	Toggle
🧩 Task Management	Scheduled tasks + visual workflow orchestration (built-in business nodes)	`task`
🔧 Code Generator	Table → full frontend/backend code	`generator`
📁 Storage	Unified file / object storage (SFTP / S3 / OSS / COS / OBS)	`storage`
🤖 AI Chat	Agno-powered agent conversations	`ai`
💬 Internal Chat	Text-only private / group chat between users (WebSocket real-time push + unread badge)	`chat`

🔧 Module Toggling

Extension modules can be enabled/disabled on demand via ENABLED_MODULES in backend/app/config/setting.py — just remove an item from the list; no code or menu deletion needed. The corresponding REST endpoints, WebSocket endpoints and initialization logic will not be loaded automatically:

# e.g. Disable internal chat and AI assistant, keep the rest
ENABLED_MODULES = ["generator", "task", "storage"]

🚦 Deployment Notes

Chat scope: Internal chat is positioned as lightweight internal communication — text-only messages. No file transfer, recall, read receipts, or multi-device sync (IM features). For strong IM needs, integrate mature products such as WeCom / DingTalk / Feishu. It can be disabled anytime by removing chat from ENABLED_MODULES.
Single-instance deployment: Real-time features (internal chat WebSocket, scheduled task scheduler) rely on in-memory connections and local scheduling within a single instance — please deploy as a single instance. For horizontal scaling, integrate Redis Pub/Sub or a message queue yourself.
Key security: Configure all third-party keys (AI, cloud storage, etc.) in the backend/env/.env.* environment variables. Never commit them to the repository or store them in the database.
Database migrations: Manage schema changes with Alembic migrations in production (uv run alembic upgrade head); create_all is only a fallback for first-time initialization.