bf694b79e2
Critical (all fixed): - bcrypt statt SHA-256 für Passwörter - API-Keys gehasht in DB, Plaintext nur einmalig zurückgegeben - DB-Session-Leak behoben (SessionLocal + try/finally, Depends(get_db)) - Admin-Check via is_admin-Spalte statt Hardcoded-Username - CORS: konfigurierbare Origins via ALLOWED_ORIGINS, kein Wildcard mit Credentials High (all fixed): - TOCTOU-Race: check_and_increment_quota mit SELECT FOR UPDATE atomar - Getrennte Tages-/Monatszähler in Usage + automatische Reset-Logik - Token-Zählung mit tiktoken (cl100k_base) statt .split() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
48 lines
1.8 KiB
Python
48 lines
1.8 KiB
Python
from sqlalchemy import Column, Integer, String, Boolean, DateTime, ForeignKey, BigInteger
|
|
from datetime import datetime
|
|
from database import Base
|
|
|
|
class User(Base):
|
|
__tablename__ = "users"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
username = Column(String, unique=True, index=True)
|
|
email = Column(String, unique=True, index=True)
|
|
hashed_password = Column(String)
|
|
is_active = Column(Boolean, default=True)
|
|
is_admin = Column(Boolean, default=False)
|
|
created_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
class APIKey(Base):
|
|
__tablename__ = "api_keys"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
name = Column(String)
|
|
key = Column(String, unique=True, index=True)
|
|
user_id = Column(Integer, ForeignKey("users.id"))
|
|
is_active = Column(Boolean, default=True)
|
|
created_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
class Quota(Base):
|
|
__tablename__ = "quotas"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
user_id = Column(Integer, ForeignKey("users.id"))
|
|
daily_tokens = Column(BigInteger, nullable=True)
|
|
monthly_tokens = Column(BigInteger, nullable=True)
|
|
daily_requests = Column(Integer, nullable=True)
|
|
monthly_requests = Column(Integer, nullable=True)
|
|
reset_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
class Usage(Base):
|
|
__tablename__ = "usage"
|
|
|
|
id = Column(Integer, primary_key=True, index=True)
|
|
user_id = Column(Integer, ForeignKey("users.id"), unique=True)
|
|
tokens_used_today = Column(BigInteger, default=0)
|
|
tokens_used_month = Column(BigInteger, default=0)
|
|
requests_today = Column(Integer, default=0)
|
|
requests_month = Column(Integer, default=0)
|
|
daily_reset_at = Column(DateTime, default=datetime.utcnow)
|
|
monthly_reset_at = Column(DateTime, default=datetime.utcnow)
|