MMD
f7b1f7f751
- main.py: global get_current_user dependency on all routers except /auth/login and /health; prod fail-fast startup guard rejects wildcard CORS, default credentials, DEV_LOGIN_ENABLED - inventory/pm: X-User-Role header identity fallback now only active when PROCUREMENT_DEV_LOGIN_ENABLED=true (was unconditional in production) - item_decisions writes + attachment deletes: require_role( procurement_manager, admin) — require_role was defined but never used - config.py: ENVIRONMENT flag, comma-separated CORS_ORIGINS, no default Casdoor client secret/admin password, DEV_LOGIN_ENABLED=false - frontend: authenticated file downloads (Bearer + blob) — <a href> links cannot send the token; FileList/QuoteDetail/AcceptModal/EditModal/ PurchaseHistory converted; DEV_LOGIN_ENABLED build arg defaults false - smoke tests authenticate via POST /auth/login (SMOKE_USER/SMOKE_PASSWORD) - traefik: security headers, API rate limit, 12MB body cap (prod overlay) - nginx client_max_body_size aligned to 12MB
20 lines
441 B
Plaintext
20 lines
441 B
Plaintext
fastapi>=0.115.0
|
|
uvicorn[standard]>=0.30.0
|
|
sqlalchemy[asyncio]>=2.0.30
|
|
asyncpg>=0.29.0
|
|
pydantic>=2.7.0
|
|
pydantic-settings>=2.2.0
|
|
python-multipart>=0.0.9
|
|
minio>=7.2.0
|
|
|
|
# v2.6 — Casdoor JWT auth
|
|
pyjwt[crypto]>=2.8.0
|
|
httpx>=0.27.0
|
|
|
|
# Casdoor seeding — bcrypt password hashes (never plaintext)
|
|
bcrypt>=4.1.0
|
|
|
|
# Observability — metrics + Sentry/GlitchTip exception capture
|
|
prometheus-fastapi-instrumentator>=7.0.0
|
|
sentry-sdk[fastapi]>=2.0.0
|