feat: harden phase 3 api security

2026-07-03 10:34:37 +08:00
parent 1c5aa7845d
commit 0168aa30ba
19 changed files with 540 additions and 46 deletions
@@ -18,6 +18,15 @@ MYSQL_WRITE_TIMEOUT=120
 # AI key encryption
 AI_KEY_ENCRYPTION_KEY=base64-fernet-key

+# API safety
+API_GENERATE_THROTTLE_RATE=60/min
+API_AUTH_FAILURE_THROTTLE_RATE=30/min
+IMAGE_URL_MAX_BYTES=10485760
+IMAGE_URL_MAX_REDIRECTS=3
+IMAGE_URL_CONNECT_TIMEOUT_SECONDS=10
+IMAGE_URL_READ_TIMEOUT_SECONDS=60
+RECHARGE_MAX_AMOUNT_CNY=100000.00
+
 # Payment callback verification
 PAYMENT_CALLBACK_MODE=mock
 PAYMENT_MOCK_CALLBACK_SECRET=change-me-mock-callback-secret