fix: harden runtime deployment defaults

backend/app/core/auth.py

@@ -64,11 +64,11 @@ async def exchange_code_for_user(code: str) -> Optional[dict]:
         "code": code,
     }
 
-    async with httpx.AsyncClient(timeout=15, verify=False) as client:
+    async with httpx.AsyncClient(timeout=15) as client:
         try:
             resp = await client.post(token_url, data=data)
             if resp.status_code != 200:
-                logger.error(f"Casdoor token 换取失败: {resp.status_code} {resp.text}")
+                logger.error("Casdoor token 换取失败: status=%s", resp.status_code)
                 return None
 
             token_data = resp.json()
@@ -77,19 +77,16 @@ async def exchange_code_for_user(code: str) -> Optional[dict]:
                 logger.error("Casdoor 返回中没有 id_token")
                 return None
 
-            # 解码 id_token (JWT) payload，不验证签名（HTTPS 已保证传输安全）
-            # 生产环境建议验证 Casdoor 证书
             cert = _load_casdoor_certificate()
-            try:
-                payload = jwt.decode(
-                    id_token,
-                    key=cert or None,
-                    options={"verify_signature": bool(cert)},
-                    audience=settings.CASDOOR_CLIENT_ID,
-                )
-            except JWTError:
-                # 不验证签名的方式解码
-                payload = jwt.get_unverified_claims(id_token)
+            if not cert:
+                logger.error("Casdoor token 验证证书未配置")
+                return None
+
+            payload = jwt.decode(
+                id_token,
+                key=cert,
+                audience=settings.CASDOOR_CLIENT_ID,
+            )
 
             return payload
 

backend/tests/test_deployment_security.py

@@ -0,0 +1,18 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_compose_does_not_embed_password_or_net_admin_capability():
+    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
+
+    assert "POSTGRES_PASSWORD=pingwatch123" not in compose
+    assert "NET_ADMIN" not in compose
+    assert "127.0.0.1:8001:8000" in compose
+
+
+def test_oauth_client_does_not_disable_tls_verification():
+    auth_source = (ROOT / "backend" / "app" / "core" / "auth.py").read_text(encoding="utf-8")
+
+    assert "verify=False" not in auth_source