fix(security): complete security and delivery compliance remediation

backend/app/core/config.py

@@ -1,6 +1,7 @@
 """应用配置"""
 import os
 from pathlib import Path
+from pydantic import model_validator
 from pydantic_settings import BaseSettings
 
 # 项目根目录（config.py 位于 backend/app/core/，parent.parent.parent 即 backend/）
@@ -11,6 +12,7 @@ class Settings(BaseSettings):
     APP_NAME: str = "H3C-ONU-MS"
     DEBUG: bool = False
     SECRET_KEY: str
+    CREDENTIAL_ENCRYPTION_KEY: str
 
     DATABASE_URL: str
     REDIS_URL: str
@@ -22,6 +24,7 @@ class Settings(BaseSettings):
     CASDOOR_APP_NAME: str
     CASDOOR_CERTIFICATE: str = ""  # 支持文件路径或直接填 PEM 内容
     CASDOOR_REDIRECT_URL: str = ""
+    CASDOOR_ISSUER: str = ""  # 为空时使用 CASDOOR_ENDPOINT
 
     SSH_TIMEOUT: int = 30
     CHECK_INTERVAL: int = 1800
@@ -48,27 +51,39 @@ class Settings(BaseSettings):
     WECHAT_PROXY_API_URL: str = ""
     IMC_API_USERNAME: str = ""
     IMC_API_PASSWORD: str = ""
-    IMC_API_VERIFY_SSL: bool = False
+    IMC_API_VERIFY_SSL: bool = True
     IMC_CONNECT_TIMEOUT: float = 5.0
     IMC_READ_TIMEOUT: float = 20.0
 
     class Config:
         env_file = str(PROJECT_ROOT / ".env")
 
+    @model_validator(mode="after")
+    def reject_insecure_imc_tls_in_production(self):
+        """Prevent production deployments from silently disabling TLS verification."""
+        if self.IMC_API_URL and not self.DEBUG and not self.IMC_API_VERIFY_SSL:
+            raise ValueError("IMC_API_VERIFY_SSL must be true when DEBUG is false")
+        return self
+
     @property
     def casdoor_cert_content(self) -> str:
         """读取证书文件内容或直接返回证书字符串"""
         cert = self.CASDOOR_CERTIFICATE
         if not cert:
             return ""
+        if "-----BEGIN" in cert:
+            return cert
         cert_path = Path(cert)
         if cert_path.is_absolute():
             path = cert_path
         else:
             # 相对路径基于项目根目录解析
             path = PROJECT_ROOT / cert
-        if path.is_file():
-            return path.read_text()
+        try:
+            if path.is_file():
+                return path.read_text()
+        except OSError:
+            pass
         return cert  # 直接是 PEM 内容