vincent 31cabbe044 feat(BIZ-108): 启用 auth_enabled + 强制 LOTTO_API_TOKEN 启动期校验
- app.py L137: 删除 'lotto2026' 默认 token 兜底
- app.py L138: auth_enabled: False → True
- app.py L147+: 启动期强制校验 token 长度 ≥ 32 字符
  - 缺失或过短 → RuntimeError fail-fast,避免静默使用默认 token
- 配套 /etc/lotto/env(root:root, 0600 权限)落盘强随机 token

验证:
- /api/status 报 auth_enabled:true
- 无/错 token → 401,正确 token → 200
- 8 个接口鉴权全部生效(generate/records/preview/compare/statistics/history/status/delete)
- BIZ-105 字段契约保持(waiting 路径零污染)
2026-08-31 14:23:21 +08:00
2026-07-04 09:21:43 +08:00
S
Description
No description provided
464 KiB
Languages
Python 61.3%
HTML 37.9%
Shell 0.8%