xiongyuxing/tiku-backend.net
1
0
Fork 1
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: strengthen P0 security and operations

Browse Source
This commit is contained in:
xiong
2026-08-01 11:20:02 +08:00
parent f776056834
commit 84c2b0b21d
77 changed files with 24185 additions and 355 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Tiku.Api/Configuration/DependencyInjection.cs
View File

@@ -3,10 +3,8 @@ using Tiku.Application;
using Tiku.Infrastructure;
using Tiku.Infrastructure.Security;
using Tiku.Api.Caching;
using Tiku.Api.BackgroundProcessing;
using Microsoft.AspNetCore.ResponseCompression;
using System.IO.Compression;
using Tiku.Application.PlatformBilling;
using Tiku.Application.Security;
using Tiku.Application.Tenancy;
using Microsoft.Extensions.DependencyInjection.Extensions;
@@ -75,21 +73,6 @@ public static class DependencyInjection
});
builder.Services.Configure<BrotliCompressionProviderOptions>(options => options.Level = CompressionLevel.Fastest);
builder.Services.Configure<GzipCompressionProviderOptions>(options => options.Level = CompressionLevel.Fastest);
builder.Services.AddOptions<BackgroundProcessingOptions>()
.Bind(builder.Configuration.GetSection(BackgroundProcessingOptions.SectionName))
.Validate(BackgroundProcessingOptions.BeValid, "Background processing settings are invalid.")
.ValidateOnStart();
builder.Services.AddOptions<DomainLifecycleOptions>()
.Bind(builder.Configuration.GetSection("TenantDomains"));
builder.Services.AddOptions<SaasSubscriptionLifecycleOptions>()
.Bind(builder.Configuration.GetSection("SaasSubscriptions"));
builder.Services.AddOptions<FeatureUsageReconciliationOptions>()
.Bind(builder.Configuration.GetSection("FeatureUsageReconciliation"));
builder.Services.AddHostedService<TenantDomainBackgroundService>();
builder.Services.AddHostedService<SaasSubscriptionBackgroundService>();
builder.Services.AddHostedService<FeatureUsageBackgroundService>();
builder.Services.AddHostedService<BackgroundJobsBackgroundService>();
builder.Services.AddApiDataProtection(builder.Configuration, builder.Environment);
builder.Services.AddExternalServiceOptions(builder.Configuration, builder.Environment);
builder.Services.AddApiAuthenticationAndAuthorization(builder.Configuration, builder.Environment);

22
Tiku.Api/Configuration/ExternalServiceOptionsExtensions.cs
View File

@@ -1,6 +1,7 @@
using Tiku.Application.Auth;
using Tiku.Infrastructure.Commerce;
using Tiku.Infrastructure.Storage;
using Tiku.Infrastructure.Assets;
namespace Tiku.Api.Configuration;
@@ -50,6 +51,27 @@ internal static class ExternalServiceOptionsExtensions
? useInternalEndpoint
: options.UseInternalEndpoint;
});
services.AddOptions<ObjectStorageOptions>()
.Validate(
options => !environment.IsProduction() ||
options.DefaultProvider == Tiku.Application.Storage.ObjectStorageProviders.AliyunOss,
"Production managed storage must use the configured Aliyun OSS provider.")
.ValidateOnStart();
services.AddOptions<AliyunOssOptions>()
.Validate<Microsoft.Extensions.Options.IOptions<ObjectStorageOptions>>(
(aliyun, storage) =>
!environment.IsProduction() ||
storage.Value.DefaultProvider != Tiku.Application.Storage.ObjectStorageProviders.AliyunOss ||
aliyun.IsConfigured,
"Aliyun OSS credentials and region or endpoint are required when it is the default provider.")
.ValidateOnStart();
services.AddOptions<ClamAvOptions>()
.Bind(configuration.GetSection(ClamAvOptions.SectionName))
.Validate(ClamAvOptions.BeValid, "ClamAV settings are invalid.")
.Validate<Microsoft.Extensions.Options.IOptions<ObjectStorageOptions>>(
(clamAv, storage) => clamAv.StreamMaxLength >= storage.Value.MaxUploadBytes,
"ClamAV StreamMaxLength must be greater than or equal to the storage max upload size.")
.ValidateOnStart();
services.AddOptions<TenantSecretEncryptionOptions>()
.Bind(configuration.GetSection(TenantSecretEncryptionOptions.SectionName))

2
Tiku.Api/Configuration/ObservabilityExtensions.cs
View File

@@ -28,7 +28,7 @@ internal static class ObservabilityExtensions
.WithMetrics(metrics => metrics
.AddAspNetCoreInstrumentation()
.AddHttpClientInstrumentation()
.AddMeter(DatabasePerformanceTelemetry.MeterName, "Tiku.Security.Redis", "Npgsql")
.AddMeter(DatabasePerformanceTelemetry.MeterName, WorkerTelemetry.MeterName, "Tiku.Security.Redis", "Npgsql")
.ApplyIf(hasOtlpEndpoint, builder => builder.AddOtlpExporter(options => options.Endpoint = endpointUri!)));
return services;