9503fca370
网页身份改由 auth-hub 做 OAuth2 + PKCE 单点登录，本地邮箱/密码登录与注册整条链路删除 （routes/auth.py、auth.py 的密码哈希、config.py 的 ALLOW_REGISTRATION）。Garmin 账号绑定/ 同步保持完全独立、可选：routes/garmin.py 不再直接查 users 表，Garmin 邮箱回退统一走新增 的 services/garmin.py::get_remembered_email()（优先读 garmin_tokens 当前绑定，兼容早期账号 落在 users.garmin_email 的历史值），彻底把「你是谁」和「你绑没绑 Garmin」两件事拆开。 - db.py: users 表新增 auth_hub_sub/auth_hub_username，MIGRATIONS 补上这两列（此前遗漏导致 已存在的生产 MariaDB 表永远不会自动加列）；同时把历史遗留的 garmin_email/ garmin_password_hash NOT NULL 约束在线迁移为可空，因为新账号不再在注册时收集这些字段。 - routes/auth.py: 修掉 /callback 路由重复拼接 /api/auth 前缀导致 404 的 bug。 - client: LoginPage 去掉本地登录/注册标签页，只保留 auth-hub 统一登录；登录成功/失败后都 用 history.replaceState 清理地址栏，修掉 Framework7 browserHistory 读取 /auth/callback?code=... 导致「找不到页面」的问题。 - 新增 test_auth_hub_client.py 锁定 find_or_create_user 按 auth_hub_sub 幂等——生产上曾经因为 这个函数在没有该测试保护时被测试触发，误建过一个空账号，靠手工核对 health_data 计数才发现。 - 生产 auth-hub 侧另行为该项目注册了正式 client（未随本次提交变更，凭证只存在服务器 .env）。 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
62 lines
2.9 KiB
Python
62 lines
2.9 KiB
Python
"""
|
|
Central configuration for the Garmin Health Lab Flask backend.
|
|
|
|
Reads settings from a `.env` file (backend/.env) and the process environment.
|
|
The same code runs against SQLite (local dev) or MariaDB (NAS production)
|
|
by switching DB_TYPE — business code never branches on the backend.
|
|
"""
|
|
import os
|
|
|
|
from dotenv import load_dotenv
|
|
|
|
# Load .env from the backend directory (falls back to cwd / parent search).
|
|
_BACKEND_DIR = os.path.dirname(os.path.abspath(__file__))
|
|
_ENV_PATH = os.path.join(_BACKEND_DIR, ".env")
|
|
if os.path.exists(_ENV_PATH):
|
|
load_dotenv(_ENV_PATH)
|
|
else:
|
|
load_dotenv() # walk up from cwd
|
|
|
|
# --- Database selection -----------------------------------------------------
|
|
DB_TYPE = (os.environ.get("DB_TYPE") or "sqlite").lower()
|
|
|
|
# SQLite (default, zero-config local development)
|
|
SQLITE_PATH = os.environ.get("DATABASE_PATH") or os.path.join(
|
|
_BACKEND_DIR, "data", "health.db"
|
|
)
|
|
|
|
# MariaDB (production, runs on the NAS)
|
|
MARIADB_SOCKET = os.environ.get("MARIADB_SOCKET") or ""
|
|
MARIADB_HOST = os.environ.get("MARIADB_HOST") or "127.0.0.1"
|
|
MARIADB_PORT = int(os.environ.get("MARIADB_PORT") or 3306)
|
|
MARIADB_USER = os.environ.get("MARIADB_USER") or "root"
|
|
MARIADB_PASSWORD = os.environ.get("MARIADB_PASSWORD") or ""
|
|
MARIADB_DATABASE = os.environ.get("MARIADB_DATABASE") or "garmin_health_lab"
|
|
|
|
# --- Auth -------------------------------------------------------------------
|
|
JWT_SECRET = os.environ.get("JWT_SECRET") or "dev_secret_change_me"
|
|
JWT_EXPIRY_DAYS = int(os.environ.get("JWT_EXPIRY_DAYS") or 7)
|
|
|
|
# auth-hub OIDC/OAuth2 provider configuration. The client secret has no
|
|
# fallback on purpose — unlike the issuer URL and client id, it must never be
|
|
# hardcoded in source; put it in backend/.env (gitignored) instead.
|
|
AUTH_HUB_BASE_URL = os.environ.get("AUTH_HUB_BASE_URL") or "http://129.146.26.249:5300"
|
|
AUTH_HUB_CLIENT_ID = os.environ.get("AUTH_HUB_CLIENT_ID") or "0asGO0FdX_XYOk6O"
|
|
AUTH_HUB_CLIENT_SECRET = os.environ.get("AUTH_HUB_CLIENT_SECRET") or ""
|
|
AUTH_HUB_REDIRECT_URI = os.environ.get("AUTH_HUB_REDIRECT_URI") or "http://129.146.26.249:8123/auth/callback"
|
|
|
|
# --- Static UI --------------------------------------------------------------
|
|
# Directory holding the built React app. When set and populated, the Flask
|
|
# process serves the UI too, so a deployment is one port and one service.
|
|
STATIC_DIR = os.environ.get("STATIC_DIR") or os.path.join(_BACKEND_DIR, "static")
|
|
|
|
# --- Server -----------------------------------------------------------------
|
|
# BACKEND_PORT wins over PORT: `PORT` is set by many dev tools and PaaS
|
|
# runtimes for the *frontend*, and letting it through made Flask seize the
|
|
# React dev server's port during `npm run dev`.
|
|
PORT = int(os.environ.get("BACKEND_PORT") or os.environ.get("PORT") or 5000)
|
|
|
|
# Comma-separated list of allowed front-end origins (CORS).
|
|
_CORS_RAW = os.environ.get("CORS_ORIGIN") or "http://localhost:3000,http://localhost:5173"
|
|
CORS_ORIGINS = [o.strip() for o in _CORS_RAW.split(",") if o.strip()]
|