fix(security): complete security and delivery compliance remediation

backend/app/core/security.py

@@ -1,6 +1,8 @@
 """JWT 安全配置"""
 from datetime import datetime, timedelta
-from jose import JWTError, jwt
+
+import jwt as pyjwt
+from jose import JWTError, jwt as jose_jwt
 from app.core.config import settings
 
 ALGORITHM = "HS256"
@@ -11,12 +13,37 @@ def create_access_token(data: dict):
     to_encode = data.copy()
     expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
     to_encode.update({"exp": expire})
-    return jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
+    return jose_jwt.encode(to_encode, settings.SECRET_KEY, algorithm=ALGORITHM)
 
 
 def verify_token(token: str):
     try:
-        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[ALGORITHM])
+        payload = jose_jwt.decode(token, settings.SECRET_KEY, algorithms=[ALGORITHM])
         return payload
     except JWTError:
         return None
+
+
+def verify_casdoor_token(token: str) -> dict:
+    """Verify a Casdoor-issued JWT before using any identity claims."""
+    certificate = settings.casdoor_cert_content.strip()
+    if not certificate:
+        raise ValueError("Casdoor certificate is not configured")
+
+    issuer = (settings.CASDOOR_ISSUER or settings.CASDOOR_ENDPOINT).rstrip("/")
+    if not issuer:
+        raise ValueError("Casdoor issuer is not configured")
+
+    header = pyjwt.get_unverified_header(token)
+    algorithm = header.get("alg")
+    if algorithm not in {"RS256", "RS384", "RS512"}:
+        raise ValueError("Unsupported Casdoor token algorithm")
+
+    return pyjwt.decode(
+        token,
+        certificate,
+        algorithms=[algorithm],
+        audience=settings.CASDOOR_CLIENT_ID,
+        issuer=issuer,
+        options={"require": ["exp", "iat", "sub"]},
+    )