fix(security): remediate telecom compliance findings

backend/app/config.py

@@ -5,11 +5,13 @@ from typing import Optional
 class Settings(BaseSettings):
     # App
     APP_NAME: str = "企迹-政企周报管理系统"
-    DEBUG: bool = True
-    SECRET_KEY: str = "change-me-in-production"
+    ENVIRONMENT: str = "production"
+    DEBUG: bool = False
+    SECRET_KEY: str = ""
 
     # Database
-    DATABASE_URL: str = "postgresql+asyncpg://postgres:postgres@localhost:5432/qiji"
+    # A syntactically valid non-working placeholder keeps tooling imports side-effect free.
+    DATABASE_URL: str = "postgresql+asyncpg://qiji_app:invalid@localhost:5432/qiji"
 
     # JWT
     JWT_ALGORITHM: str = "HS256"
@@ -24,11 +26,11 @@ class Settings(BaseSettings):
     CASDOOR_APPLICATION: str = "qiji-weekly-report"
 
     # MinIO
-    MINIO_ENDPOINT: str = "localhost:9000"
-    MINIO_ACCESS_KEY: str = "minioadmin"
-    MINIO_SECRET_KEY: str = "minioadmin"
+    MINIO_ENDPOINT: str = ""
+    MINIO_ACCESS_KEY: str = ""
+    MINIO_SECRET_KEY: str = ""
     MINIO_BUCKET: str = "qiji-photos"
-    MINIO_SECURE: bool = False
+    MINIO_SECURE: bool = True
 
     # WeChat Work
     WECOM_CORP_ID: str = ""
@@ -53,3 +55,24 @@ class Settings(BaseSettings):
 
 
 settings = Settings()
+
+
+def validate_security_settings() -> None:
+    """Reject unsafe or incomplete configuration before the application starts."""
+    if settings.ENVIRONMENT.lower() == "development":
+        return
+
+    invalid = []
+    if len(settings.SECRET_KEY) < 32 or settings.SECRET_KEY in {"change-me-in-production", ""}:
+        invalid.append("SECRET_KEY")
+    if not settings.DATABASE_URL or "postgres:postgres@" in settings.DATABASE_URL or ":invalid@" in settings.DATABASE_URL:
+        invalid.append("DATABASE_URL")
+    if not settings.MINIO_ENDPOINT or not settings.MINIO_ACCESS_KEY or not settings.MINIO_SECRET_KEY:
+        invalid.append("MINIO configuration")
+    if settings.MINIO_ACCESS_KEY == "minioadmin" or settings.MINIO_SECRET_KEY == "minioadmin":
+        invalid.append("MINIO default credentials")
+    if not settings.MINIO_SECURE:
+        invalid.append("MINIO_SECURE")
+
+    if invalid:
+        raise RuntimeError(f"Unsafe production configuration: {', '.join(invalid)}")