Merge branch 'master' of http://git.zhenyangtang.com.cn/ZYT/zyt

2026-10-23 09:27:45 +08:00
parent 4880e96de3 1cbe8bfe54
commit 1224b02e40
34 changed files with 2866 additions and 225 deletions
@@ -0,0 +1,70 @@
+"""Start the source workstation against a loopback backend with isolated login state."""
+from __future__ import annotations
+
+import functools
+import os
+import socket
+import sys
+from pathlib import Path
+from urllib.parse import urlsplit
+
+import certifi
+
+
+def validate_local_url(api: str) -> None:
+    parsed = urlsplit(api)
+    if (parsed.scheme != "https" or not parsed.hostname or parsed.username or parsed.password
+            or parsed.query or parsed.fragment):
+        raise ValueError("本地入口需要不带凭据的 HTTPS 地址")
+    addresses = {row[4][0] for row in socket.getaddrinfo(parsed.hostname, parsed.port or 443)}
+    if not addresses or not addresses <= {"127.0.0.1", "::1"}:
+        raise ValueError("本地入口仅连接解析到本机的后端")
+
+
+def validate_effective_config(config, requested_api: str) -> None:
+    from doctor_workstation.config import normalize_api_base_url
+    validate_local_url(config.api_base_url)
+    if config.api_base_url != normalize_api_base_url(requested_api) or not config.verify_ssl:
+        raise ValueError("本地独立配置已改动，请在 .local-workstation/config 中核对本地服务器设置")
+
+
+def main() -> int:
+    root = Path(__file__).resolve().parents[1]
+    api = os.environ.get("DOCTOR_LOCAL_API_URL", "https://css.zhenyangtang.com.cn")
+    validate_local_url(api)
+    certificate = Path(os.environ.get(
+        "DOCTOR_LOCAL_CA_FILE",
+        "D:/phpstudy_pro/Extensions/Nginx1.15.11/conf/ssl/css.zhenyangtang.com.cn.pem",
+    ))
+    private_root = root / ".local-workstation"
+    private_root.mkdir(parents=True, exist_ok=True)
+    ca_bundle = private_root / "trusted-ca.pem"
+    ca_bundle.write_bytes(Path(certifi.where()).read_bytes() + b"\n" + certificate.read_bytes())
+    os.environ.update({
+        "DOCTOR_CONFIG_DIR": str(private_root / "config"),
+        "DOCTOR_LOG_DIR": str(private_root / "logs"),
+        "DOCTOR_API_BASE_URL": api,
+        "DOCTOR_DEMO_MODE": "false",
+        "DOCTOR_VERIFY_SSL": "true",
+        "SSL_CERT_FILE": str(ca_bundle),
+    })
+    sys.path.insert(0, str(root / "src"))
+    import doctor_workstation
+    # This explicit source-only entry does not edit the formal build configuration.
+    doctor_workstation.DEBUG_MODE = True
+    from doctor_workstation.config import AppConfig
+    config = AppConfig.load()
+    validate_effective_config(config, api)
+    if "--check" in sys.argv:
+        print("Local backend: loopback HTTPS; TLS verification enabled; isolated configuration and credential namespace")
+        return 0
+    from doctor_workstation import app as workstation_app
+    # The normal credential service remains untouched even after a local login.
+    workstation_app.TokenStore = functools.partial(
+        workstation_app.TokenStore, service_name="zyt-doctor-workstation-local-source"
+    )
+    return workstation_app.main()
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())