rebuild(stage-3): establish accounts permissions and secure settings

next/backend/bootstrap/container.py

@@ -5,6 +5,14 @@ from dataclasses import dataclass
 from backend.bootstrap.settings import Settings
 from backend.database.connection import Database
 from backend.database.repositories.status import DatabaseStatusRepository
+from backend.features.accounts.credentials import SystemCredentialService
+from backend.features.accounts.model_pool import ModelPoolRepository, ModelPoolService
+from backend.features.accounts.repository import AccountRepository, SystemCredentialRepository
+from backend.features.accounts.service import (
+    AccountService,
+    MembershipService,
+)
+from backend.security import PasswordHasher, load_or_create_cipher
 
 
 @dataclass(frozen=True, slots=True)
@@ -12,12 +20,24 @@ class ApplicationContainer:
     settings: Settings
     database: Database
     database_status: DatabaseStatusRepository
+    accounts: AccountService
+    memberships: MembershipService
+    system_credentials: SystemCredentialService
+    model_pool: ModelPoolService
 
 
 def build_container(settings: Settings) -> ApplicationContainer:
     database = Database(settings.database_path)
+    account_repository = AccountRepository()
+    credential_repository = SystemCredentialRepository()
+    model_pool_repository = ModelPoolRepository()
+    cipher = load_or_create_cipher(settings)
     return ApplicationContainer(
         settings=settings,
         database=database,
         database_status=DatabaseStatusRepository(database),
+        accounts=AccountService(database, account_repository, PasswordHasher(), cipher),
+        memberships=MembershipService(database, account_repository),
+        system_credentials=SystemCredentialService(database, credential_repository, cipher),
+        model_pool=ModelPoolService(database, model_pool_repository, cipher),
     )

next/backend/bootstrap/settings.py

@@ -38,6 +38,7 @@ class Settings:
     log_level: str
     host: str
     port: int
+    encryption_key: str | None
     timezone: str = "Asia/Shanghai"
 
     @classmethod
@@ -60,6 +61,9 @@ class Settings:
         log_level = os.getenv("APP_LOG_LEVEL", "INFO").strip().upper()
         if log_level not in {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"}:
             raise ConfigurationError("APP_LOG_LEVEL is invalid")
+        encryption_key = os.getenv("APP_ENCRYPTION_KEY", "").strip() or None
+        if environment == "production" and encryption_key is None:
+            raise ConfigurationError("APP_ENCRYPTION_KEY is required in production")
         return cls(
             environment=environment,
             debug=environment == "development",
@@ -69,6 +73,7 @@ class Settings:
             log_level=log_level,
             host=os.getenv("APP_HOST", "127.0.0.1").strip() or "127.0.0.1",
             port=_parse_port(os.getenv("APP_PORT", "8780")),
+            encryption_key=encryption_key,
             timezone=timezone,
         )
 
@@ -84,4 +89,5 @@ class Settings:
             log_level="CRITICAL",
             host="127.0.0.1",
             port=8780,
+            encryption_key=None,
         )