fix(security): remediate telecom compliance findings

backend/app/api/auth.py

@@ -58,36 +58,16 @@ async def wecom_login(req: WecomLoginRequest, db: AsyncSession = Depends(get_db)
             role=user.role,
         )
 
-    # Not bound yet — return a redirect URL to Casdoor for binding
-    casdoor_auth_url = (
-        f"{settings.CASDOOR_ENDPOINT}/login/oauth/authorize"
-        f"?client_id={settings.CASDOOR_CLIENT_ID}"
-        f"&response_type=code"
-        f"&redirect_uri={settings.CORS_ORIGINS[0]}/bind-wecom"
-        f"&scope=openid+profile"
-        f"&state={wecom_userid}"
+    raise HTTPException(
+        status_code=403,
+        detail="企业微信账号尚未绑定。请在企业微信内使用一次性绑定链接完成绑定。",
     )
-    return {"need_bind": True, "casdoor_url": casdoor_auth_url, "wecom_userid": wecom_userid}
 
 
 @router.post("/bind-wecom")
 async def bind_wecom(req: WecomBindRequest, db: AsyncSession = Depends(get_db)):
-    """Bind Casdoor account with WeChat Work userid after OIDC redirect."""
-    userinfo = await exchange_casdoor_code(req.casdoor_code)
-    if not userinfo:
-        raise HTTPException(status_code=400, detail="Failed to exchange casdoor code")
-
-    casdoor_id = userinfo.get("sub") or userinfo.get("id")
-    wecom_userid = req.wecom_userid or userinfo.get("state", "")
-
-    user = await bind_wecom_user(db, casdoor_id, wecom_userid)
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-
-    token = build_token_for_user(user)
-    return TokenResponse(
-        access_token=token,
-        user_id=str(user.id),
-        name=user.name,
-        role=user.role,
+    """Deprecated unsafe binding flow. Use /wecom/bind-confirm with a one-time token."""
+    raise HTTPException(
+        status_code=410,
+        detail="该绑定接口已停用，请使用企业微信一次性绑定链接。",
     )

backend/app/api/system_config.py

@@ -46,7 +46,10 @@ async def get_notification_time(db: AsyncSession) -> str:
 
 
 @router.get("")
-async def list_config(db: AsyncSession = Depends(get_db)):
+async def list_config(
+    current_user: dict = Depends(require_director),
+    db: AsyncSession = Depends(get_db),
+):
     """Return all system config as {key: value} dict."""
     result = await db.execute(select(SystemConfig))
     rows = result.scalars().all()

backend/app/api/upload.py

@@ -1,10 +1,48 @@
 import uuid
-from fastapi import APIRouter, Depends
+from datetime import date
+from pathlib import PurePosixPath
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.database import get_db
 from app.middleware.auth import get_current_user, require_any_role
 from app.services.minio_client import generate_presigned_upload_url, generate_presigned_download_url
+from app.models.visit import Visit
 
 router = APIRouter(prefix="/upload", tags=["Upload"])
 
+_IMAGE_TYPES = {
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/webp": "webp",
+}
+
+
+def validate_image_upload(filename: str, content_type: str) -> str:
+    """Validate client-declared image metadata before issuing a short-lived PUT URL."""
+    extension = _IMAGE_TYPES.get(content_type.lower())
+    if not extension:
+        raise HTTPException(status_code=400, detail="Only JPEG, PNG, and WebP images are supported")
+    if PurePosixPath(filename).suffix.lower() not in {".jpg", ".jpeg", ".png", ".webp"}:
+        raise HTTPException(status_code=400, detail="Invalid image filename extension")
+    return extension
+
+
+def build_object_key(user_id: str, extension: str) -> str:
+    return f"uploads/{user_id}/{date.today().isoformat()}/{uuid.uuid4().hex}.{extension}"
+
+
+def is_owned_upload_key(object_key: str, user_id: str) -> bool:
+    path = PurePosixPath(object_key)
+    parts = path.parts
+    return (
+        len(parts) == 4
+        and parts[0] == "uploads"
+        and parts[1] == user_id
+        and ".." not in parts
+        and path.suffix.lower() in {".jpg", ".png", ".webp"}
+    )
+
 
 @router.post("/presigned-url")
 async def get_presigned_upload_url(
@@ -13,10 +51,8 @@ async def get_presigned_upload_url(
     current_user: dict = Depends(require_any_role),
 ):
     """Get a presigned PUT URL for direct MinIO upload."""
-    import datetime
-    today = datetime.date.today().isoformat()
-    user_id = current_user["user_id"][:8]
-    object_key = f"{today}/{user_id}/{uuid.uuid4()}.jpg"
+    extension = validate_image_upload(filename, content_type)
+    object_key = build_object_key(current_user["user_id"], extension)
 
     url = generate_presigned_upload_url(object_key)
 
@@ -30,7 +66,14 @@ async def get_presigned_upload_url(
 async def get_presigned_download_url(
     object_key: str,
     current_user: dict = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
 ):
     """Get a presigned GET URL for viewing a photo (1 hour validity)."""
+    result = await db.execute(select(Visit).where(Visit.photos.any(object_key)).limit(1))
+    visit = result.scalar_one_or_none()
+    if not visit:
+        raise HTTPException(status_code=404, detail="Photo not found")
+    if current_user["role"] == "manager" and str(visit.manager_id) != current_user["user_id"]:
+        raise HTTPException(status_code=403, detail="Access denied")
     url = generate_presigned_download_url(object_key)
     return {"download_url": url}

backend/app/api/visits.py

@@ -12,11 +12,21 @@ from app.models.user import User
 from app.schemas.visit import VisitCreate, VisitUpdate, VisitOut, VisitListOut
 from app.utils.timezone import today_cst, parse_date
 from app.services.minio_client import delete_objects
+from app.api.upload import is_owned_upload_key
 from app.utils.edit_log import compute_diff, append_entry, init_entry
 
 router = APIRouter(prefix="/visits", tags=["Visits"])
 
 
+def _validate_photo_keys(photo_keys: list[str], user_id: str, existing_keys: list[str] | None = None) -> None:
+    if len(photo_keys) > 9:
+        raise HTTPException(status_code=400, detail="A visit may contain at most 9 photos")
+    existing = set(existing_keys or [])
+    for key in photo_keys:
+        if key not in existing and not is_owned_upload_key(key, user_id):
+            raise HTTPException(status_code=400, detail="Invalid or unauthorized photo reference")
+
+
 async def _enrich_visit(visit: Visit, db: AsyncSession) -> dict:
     """Enrich a visit record with customer/manager names."""
     customer_name = None
@@ -137,6 +147,7 @@ async def create_visit(
     db: AsyncSession = Depends(get_db),
 ):
     """Create a visit record. If companions are selected, creates draft copies for them."""
+    _validate_photo_keys(data.photos, current_user["user_id"])
     visit = Visit(
         customer_id=data.customer_id,
         visit_date=parse_date(data.visit_date),
@@ -209,6 +220,9 @@ async def update_visit(
     if current_user["role"] == "manager" and str(visit.manager_id) != current_user["user_id"]:
         raise HTTPException(status_code=403, detail="Access denied")
 
+    if data.photos is not None:
+        _validate_photo_keys(data.photos, current_user["user_id"], visit.photos or [])
+
     # Snapshot old values for diff
     old_snapshot = {
         "customer_id": str(visit.customer_id), "visit_date": str(visit.visit_date),

backend/app/api/wecom.py

@@ -111,15 +111,15 @@ async def wecom_callback_event(request: Request):
 
     import logging
     _log = logging.getLogger("wecom_callback")
-    _log.warning(f"wecom msg: type={msg_type} from={from_user} content={repr(content)} event={event} key={event_key}")
+    _log.info("wecom callback received: type=%s event=%s key=%s", msg_type, event, event_key)
 
     # Triggers for binding
     if (msg_type == "text" and content == "绑定") or (msg_type == "event" and event == "click" and event_key == "BIND_ACCOUNT"):
-        _log.warning(f"wecom bind triggered for {from_user}")
+        _log.info("wecom bind triggered")
         _handle_bind_request(from_user)
         return PlainTextResponse(content="success")
 
-    _log.warning(f"wecom msg ignored (no match)")
+    _log.info("wecom message ignored (no matching action)")
     return PlainTextResponse(content="success")