提交

backend/app/api/admin/keys.py

@@ -69,6 +69,8 @@ async def rotate_key(
     current_admin = Depends(get_current_admin)
 ):
     """立即更新密钥"""
+    from app.models.system_config import SystemConfig
+
     # 获取当前激活的密钥
     current_key = db.query(APIKey).filter(APIKey.is_active == 1).order_by(APIKey.key_version.desc()).first()
 
@@ -76,15 +78,9 @@ async def rotate_key(
     new_key_pair = encryptor.generate_key_pair()
     new_version = (current_key.key_version + 1) if current_key else 1
 
-    # 获取配置，确定过期时间
-    config = db.query(KeyRotationConfig).first()
-    rotation_days = config.rotation_days if config else settings.KEY_ROTATION_DAYS
-    expire_at = beijing_now() + timedelta(days=rotation_days)
-
-    # 禁用旧密钥
-    if current_key:
-        current_key.is_active = 0
-        current_key.updated_at = beijing_now()
+    # 获取配置，确定过期时间（使用system_config表中的key_expire_minutes，默认60分钟）
+    expire_minutes = SystemConfig.get_config_value('key_expire_minutes', 60)
+    expire_at = beijing_now() + timedelta(minutes=expire_minutes)
 
     # 创建新密钥
     new_key = APIKey(
@@ -103,8 +99,6 @@ async def rotate_key(
 
     # 创建历史记录
     from app.utils.history import create_api_key_history, create_operation_log
-    if current_key:
-        create_api_key_history(db, current_key, "UPDATE")
     create_api_key_history(db, new_key, "INSERT")
 
     # 记录操作日志
@@ -114,10 +108,10 @@ async def rotate_key(
         db=db,
         admin_id=current_admin.id,
         module="密钥管理",
-        action="密钥轮换",
-        description=f"执行密钥轮换：版本 {old_version} -> {new_version}",
+        action="手动密钥轮换",
+        description=f"执行手动密钥轮换：版本 {old_version} -> {new_version}",
         old_data={"old_version": old_version},
-        new_data={"new_version": new_version, "rotation_days": rotation_days},
+        new_data={"new_version": new_version, "expire_minutes": expire_minutes},
         ip_address=client_ip
     )
 

backend/app/api/client/announcement.py

@@ -137,6 +137,9 @@ async def get_announcement(
             # JSON解析
             params: Dict[str, Any] = json.loads(decrypted_bytes.decode('utf-8'))
 
+            # 记录解密后的参数（用于调试）
+            logger.debug(f"[公告接口解密] 解密后的请求参数: {json.dumps(params, ensure_ascii=False, indent=2)}")
+
         except Exception as e:
             logger.exception("请求参数解密失败")
             return {

backend/app/api/client/auth.py

@@ -96,6 +96,10 @@ def _process_mode_b_request(data: dict, db: Session) -> tuple[dict, bytes]:
         decrypted_bytes = decryptor.update(encrypted_payload) + decryptor.finalize()
 
         params = json.loads(decrypted_bytes.decode("utf-8"))
+
+        # 记录解密后的参数（用于调试）
+        logger.debug(f"[Mode B解密] 解密后的请求参数: {json.dumps(params, ensure_ascii=False, indent=2)}")
+
         return params, aes_key_bytes
 
     except HTTPException:

backend/app/api/client/keys.py

@@ -15,6 +15,7 @@ from app.database import get_db
 from app.models.api_key import APIKey
 from app.core.encrypt import encryptor
 from app.utils.timestamp_validator import TimestampValidator
+from app.utils.timezone import beijing_now
 from app.config import settings
 from app.core.logger import logger
 

backend/app/core/encrypt.py

@@ -69,11 +69,6 @@ class RSAEncryptor:
     def load_key_by_version(self, db: Session, key_version: int) -> bool:
         """根据版本号加载密钥（主is_active，辅expire_at）"""
         try:
-            if key_version in self.key_cache:
-                private_pem, _ = self.key_cache[key_version]
-                self.load_private_key(private_pem, key_version)
-                return True
-
             # 查找指定版本的密钥，必须激活、未删除且未过期
             api_key = db.query(APIKey).filter(
                 APIKey.key_version == key_version,
@@ -86,6 +81,19 @@ class RSAEncryptor:
                 logger.warning(f"未找到有效的密钥版本 {key_version}（可能未激活、已过期或已删除）")
                 return False
 
+            # 检查缓存是否仍然有效（激活状态可能已改变）
+            if key_version in self.key_cache:
+                cached_private_pem, cached_public_pem = self.key_cache[key_version]
+                # 验证缓存内容是否与数据库完全一致
+                if cached_private_pem == api_key.private_key and cached_public_pem == api_key.public_key:
+                    # 缓存有效，直接使用
+                    self.load_private_key(cached_private_pem, key_version)
+                    return True
+                else:
+                    # 缓存已过期或不一致，清除旧缓存
+                    del self.key_cache[key_version]
+                    logger.info(f"清除过期缓存: 版本 {key_version}")
+
             self.load_private_key(api_key.private_key, key_version)
             self.key_cache[key_version] = (api_key.private_key, api_key.public_key)
             return True

client-tauri/src-tauri/src/commands.rs

@@ -1468,7 +1468,7 @@ pub async fn secure_get_announcements(request: AnnouncementRequest) -> Result<An
 
     // 8. 发送HTTP请求
     let client = Client::new();
-    let api_url = "http://localhost:8000/api/announcement"; // 这里应该从配置获取
+    let api_url = format!("{}/api/announcement", get_api_base_url()?);
 
     let response = client
         .post(api_url)
@@ -1548,6 +1548,7 @@ pub async fn secure_get_announcements(request: AnnouncementRequest) -> Result<An
 }
 
 #[tauri::command]
+pub fn get_rsa_key_version() -> Result<i32, String> {
     unsafe {
         STORED_RSA_KEY_VERSION.ok_or("RSA公钥版本不存在".to_string())
     }

client-tauri/src-tauri/target/debug/.fingerprint/openssl-8e72f163824ced26/lib-openssl

@@ -0,0 +1 @@
+d748bcc360bada3c

client-tauri/src-tauri/target/debug/.fingerprint/openssl-sys-16dc43133075ce32/lib-openssl_sys

@@ -0,0 +1 @@
+f1b8dcfeb53ff9ec

client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/stderr

@@ -1,4 +1,15 @@
 DEBUG: all keys: APPLINKDIR, BINDIR, CMAKECONFIGDIR, ENGINESDIR, INCLUDEDIR, LDLIBS, LIBDIR, MODULESDIR, PKGCONFIGDIR, PREFIX, VERSION, libdir
+DEBUG: PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install => PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install
+DEBUG: libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib => libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib
+DEBUG: BINDIR = bin => BINDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/bin, BINDIR_REL_PREFIX = bin
+DEBUG: LIBDIR = lib => LIBDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib, LIBDIR_REL_PREFIX = lib
+DEBUG: INCLUDEDIR = include => INCLUDEDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include, INCLUDEDIR_REL_PREFIX = include
+DEBUG: APPLINKDIR = include/openssl => APPLINKDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include/openssl, APPLINKDIR_REL_PREFIX = include/openssl
+DEBUG: ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3 => ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3, ENGINESDIR_REL_LIBDIR = engines-3
+DEBUG: MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules => MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules, MODULESDIR_REL_LIBDIR = ossl-modules
+DEBUG: PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig => PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig, PKGCONFIGDIR_REL_LIBDIR = pkgconfig
+DEBUG: CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL => CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL, CMAKECONFIGDIR_REL_LIBDIR = cmake/OpenSSL
+DEBUG: all keys: APPLINKDIR, BINDIR, CMAKECONFIGDIR, ENGINESDIR, INCLUDEDIR, LDLIBS, LIBDIR, MODULESDIR, PKGCONFIGDIR, PREFIX, VERSION, libdir
 No value given for CMAKECONFIGDIR
 No value given for PKGCONFIGDIR
 No value given for libdir
@@ -12,14 +23,3 @@ DEBUG: ENGINESDIR = engines => ENGINESDIR = /Users/wuzilong/work/00code/Buff/cli
 DEBUG: MODULESDIR = providers => MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/build/src/providers, MODULESDIR_REL_LIBDIR = providers
 DEBUG: PKGCONFIGDIR = . => PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/build/src, PKGCONFIGDIR_REL_LIBDIR = .
 DEBUG: CMAKECONFIGDIR = . => CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/build/src, CMAKECONFIGDIR_REL_LIBDIR = .
-DEBUG: all keys: APPLINKDIR, BINDIR, CMAKECONFIGDIR, ENGINESDIR, INCLUDEDIR, LDLIBS, LIBDIR, MODULESDIR, PKGCONFIGDIR, PREFIX, VERSION, libdir
-DEBUG: PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install => PREFIX = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install
-DEBUG: libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib => libdir = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib
-DEBUG: BINDIR = bin => BINDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/bin, BINDIR_REL_PREFIX = bin
-DEBUG: LIBDIR = lib => LIBDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib, LIBDIR_REL_PREFIX = lib
-DEBUG: INCLUDEDIR = include => INCLUDEDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include, INCLUDEDIR_REL_PREFIX = include
-DEBUG: APPLINKDIR = include/openssl => APPLINKDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/include/openssl, APPLINKDIR_REL_PREFIX = include/openssl
-DEBUG: ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3 => ENGINESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/engines-3, ENGINESDIR_REL_LIBDIR = engines-3
-DEBUG: MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules => MODULESDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/ossl-modules, MODULESDIR_REL_LIBDIR = ossl-modules
-DEBUG: PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig => PKGCONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/pkgconfig, PKGCONFIGDIR_REL_LIBDIR = pkgconfig
-DEBUG: CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL => CMAKECONFIGDIR = /Users/wuzilong/work/00code/Buff/client-tauri/src-tauri/target/debug/build/openssl-sys-74f77a4301a03bdd/out/openssl-build/install/lib/cmake/OpenSSL, CMAKECONFIGDIR_REL_LIBDIR = cmake/OpenSSL