fix: fail closed on production settings

2026-08-04 11:05:04 +08:00
parent 44bf6e003e
commit fd9bb0a436
3 changed files with 33 additions and 2 deletions
@@ -6,7 +6,7 @@ from app.config import LEGACY_DEFAULT_SECRET, Settings
 def validate_runtime_settings(settings: Settings) -> None:
    """Reject unsafe settings before scheduling monitoring work."""
    if settings.environment == "production":
-        if settings.secret_key == LEGACY_DEFAULT_SECRET:
+        if not settings.secret_key.strip() or settings.secret_key == LEGACY_DEFAULT_SECRET:
            raise ValueError("SECRET_KEY must be provided by the runtime environment")
        if not settings.casdoor_endpoint.startswith("https://"):
            raise ValueError("CASDOOR endpoint must use TLS in production")