rebuild(stage-15): complete governance and handoff

2026-07-30 08:46:12 +08:00
parent fa7a8dde06
commit d1b3b977d2
14 changed files with 498 additions and 13 deletions
@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from fastapi import FastAPI, Request, Response
+
+
+def install_security_headers(application: FastAPI) -> None:
+    @application.middleware("http")
+    async def security_headers(request: Request, call_next) -> Response:
+        response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["Referrer-Policy"] = "same-origin"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+        if request.app.state.settings.environment == "production":
+            response.headers["Content-Security-Policy"] = (
+                "default-src 'self'; base-uri 'self'; frame-ancestors 'none'; "
+                "form-action 'self'; img-src 'self' data:; font-src 'self'; "
+                "style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self'"
+            )
+            if request.url.scheme == "https":
+                response.headers["Strict-Transport-Security"] = (
+                    "max-age=31536000; includeSubDomains"
+                )
+        return response