Harden exposed security-sensitive endpoints

.gitignore

@@ -52,6 +52,10 @@ migration-backup-*/
 migration-backup-complete/
 *.dump
 *.sql
+*.zip
+*.tar
+*.tar.gz
+*.tgz
 migration-*.log
 migration-*.txt
 

app/api/jobs/archive-videos/route.ts

@@ -22,10 +22,10 @@ function verifyAuthToken(request: Request): boolean {
   // 与环境变量中的密钥比对
   const cronSecret = process.env.CRON_SECRET;
   
-  // 如果未配置 CRON_SECRET，则允许所有请求（开发环境）
+  // 安全默认拒绝：定时任务接口被 middleware 公开放行，生产环境不能在缺少密钥时放开。
   if (!cronSecret) {
-    console.warn("[VideoArchiveAPI] ⚠️  CRON_SECRET 未配置，允许所有请求");
-    return true;
+    console.error("[VideoArchiveAPI] CRON_SECRET 未配置，拒绝执行定时任务接口");
+    return false;
   }
 
   return token === cronSecret;
@@ -109,4 +109,3 @@ export async function GET(request: Request) {
     );
   }
 }
-

app/api/jobs/dingtalk-notifications/route.ts

@@ -10,10 +10,8 @@ function verifyAuthToken(request: Request): boolean {
   const cronSecret = process.env.CRON_SECRET;
 
   if (!cronSecret) {
-    console.warn(
-      "[DingTalkNotificationJob] CRON_SECRET 未配置，当前允许所有请求",
-    );
-    return true;
+    console.error("[DingTalkNotificationJob] CRON_SECRET 未配置，拒绝执行定时任务接口");
+    return false;
   }
 
   return token === cronSecret;

app/api/jobs/migrate-oss-images/route.ts

@@ -10,8 +10,8 @@ function verifyAuthToken(request: Request): boolean {
   const cronSecret = process.env.CRON_SECRET;
 
   if (!cronSecret) {
-    console.warn("[OSSMigrationAPI] ⚠️ CRON_SECRET 未配置，允许所有请求");
-    return true;
+    console.error("[OSSMigrationAPI] CRON_SECRET 未配置，拒绝执行定时任务接口");
+    return false;
   }
 
   return token === cronSecret;
@@ -68,4 +68,3 @@ export async function GET(request: Request) {
     );
   }
 }
-

app/api/site-settings/route.ts

@@ -922,6 +922,14 @@ export async function GET(request: NextRequest) {
       return getAgentWorkflowAdminSettingsResponse();
     }
 
+    if (!session?.user) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    if (!isAdmin && !canManageAgentWorkflow) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
     const [
       settings,
       notificationSetting,

auto-deploy.sh

@@ -9,7 +9,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 REMOTE_DIR="/var/www/ai-chatbot"
 
 # 颜色输出

auto_deploy.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 set local_script "remote_deploy_dreamomni2.sh"
 set remote_script "/root/remote_deploy_dreamomni2.sh"
 

backup-old-server.sh

@@ -8,7 +8,7 @@ set -e
 OLD_SERVER="156.225.27.52"
 OLD_PORT="5204"
 OLD_USER="root"
-OLD_PASS="Jsjj@8888"
+OLD_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 BACKUP_DIR="./migration-backup-$(date +%Y%m%d_%H%M%S)"
 
 echo "=========================================="

check_server.exp

@@ -3,7 +3,7 @@ set timeout 30
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 spawn ssh -o StrictHostKeyChecking=no -p $port $user@$host "echo 'Connected successfully' && nvidia-smi"
 expect {

check_status.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 spawn ssh -p $port $user@$host "
     echo '--- GPU Status ---'

complete-deploy.sh

@@ -6,7 +6,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 ssh_cmd() {
     sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -p $PORT $USER@$SERVER "$1"

deploy-fix.sh

@@ -10,7 +10,7 @@ PUBLIC_PASS="it5NuKGemX"
 
 PRIVATE_HOST="192.168.150.22"
 PRIVATE_USER="root"
-PRIVATE_PASS="Jsjj@8888"
+PRIVATE_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 echo "=========================================="
 echo "部署重定向修复"

deploy.sh

@@ -9,7 +9,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 REMOTE_DIR="/var/www/ai-chatbot"
 LOCAL_DIR="."
 

dreamomni2-deploy-guide.md

@@ -4,7 +4,7 @@
 - **IP**: 156.225.27.52
 - **端口**: 5204
 - **用户**: root
-- **密码**: Jsjj@8888
+- **密码**: <DEPLOY_SSH_PASSWORD>
 
 ## 🚀 快速部署步骤
 
@@ -14,7 +14,7 @@
 ssh -p 5204 root@156.225.27.52
 ```
 
-输入密码: `Jsjj@8888`
+输入密码: `<DEPLOY_SSH_PASSWORD>`
 
 ### 步骤 2: 上传部署脚本
 

final-deploy.sh

@@ -6,7 +6,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 ssh_cmd() {
     sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=30 -p $PORT $USER@$SERVER "$1"

finish_setup.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 puts "--> Connecting to finish installation..."
 

fix-deploy.sh

@@ -6,7 +6,7 @@ set -e
 SERVER="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 ssh_cmd() {
     sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=30 -p $PORT $USER@$SERVER "$1"

fix-frpc-access.sh

@@ -6,7 +6,7 @@
 HOST="156.225.27.52"
 PORT="5204"
 USER="root"
-PASSWORD="Jsjj@8888"
+PASSWORD="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 echo "=========================================="
 echo "FRPC 访问问题诊断和修复"

fix-redirect-issue.sh

@@ -10,7 +10,7 @@ PUBLIC_PASS="it5NuKGemX"
 
 PRIVATE_HOST="192.168.150.22"
 PRIVATE_USER="root"
-PRIVATE_PASS="Jsjj@8888"
+PRIVATE_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 APP_URL="http://156.225.27.52:5245"
 

migrate-server.sh

@@ -9,7 +9,7 @@ set -e  # 遇到错误立即退出
 OLD_SERVER="156.225.27.52"
 OLD_PORT="5204"
 OLD_USER="root"
-OLD_PASS="Jsjj@8888"
+OLD_PASS="${DEPLOY_SSH_PASSWORD:?set DEPLOY_SSH_PASSWORD}"
 
 NEW_SERVER="114.66.31.51"
 NEW_PORT="22"

run_test.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 # 定义测试指令
 # 这是一个更通用的测试命令，先尝试列出文件确认脚本名

run_test_fixed.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 # 定义正确的模型路径
 set base_dir "/root/ai-projects/DreamOmni2"

run_test_offline.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 
 # 定义正确的模型路径
 set base_dir "/root/ai-projects/DreamOmni2"

upload_and_deploy.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 set remote_script "/root/remote_setup.sh"
 
 # 1. Upload Setup Script (small file, scp is fine)

upload_flux.exp

@@ -4,7 +4,7 @@ set timeout -1
 set host "156.225.27.52"
 set port "5204"
 set user "root"
-set password "Jsjj@8888"
+set password $env(DEPLOY_SSH_PASSWORD)
 set local_model_dir "FLUX_Model"
 set remote_base_dir "/root/ai-projects/DreamOmni2/checkpoints"
 

部署状态总结.md

@@ -129,7 +129,7 @@ cd /Users/lanmu/Desktop/ai-chatbot-main
 npm run build
 
 # 上传并重启
-sshpass -p "Jsjj@8888" ssh -p 5204 root@156.225.27.52 "
+sshpass -p "<DEPLOY_SSH_PASSWORD>" ssh -p 5204 root@156.225.27.52 "
   cd /var/www/ai-chatbot && \
   npm run build && \
   pm2 restart ai-chatbot