rebuild(stage-3): establish accounts permissions and secure settings

next/backend/bootstrap/settings.py

@@ -38,6 +38,7 @@ class Settings:
     log_level: str
     host: str
     port: int
+    encryption_key: str | None
     timezone: str = "Asia/Shanghai"
 
     @classmethod
@@ -60,6 +61,9 @@ class Settings:
         log_level = os.getenv("APP_LOG_LEVEL", "INFO").strip().upper()
         if log_level not in {"DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"}:
             raise ConfigurationError("APP_LOG_LEVEL is invalid")
+        encryption_key = os.getenv("APP_ENCRYPTION_KEY", "").strip() or None
+        if environment == "production" and encryption_key is None:
+            raise ConfigurationError("APP_ENCRYPTION_KEY is required in production")
         return cls(
             environment=environment,
             debug=environment == "development",
@@ -69,6 +73,7 @@ class Settings:
             log_level=log_level,
             host=os.getenv("APP_HOST", "127.0.0.1").strip() or "127.0.0.1",
             port=_parse_port(os.getenv("APP_PORT", "8780")),
+            encryption_key=encryption_key,
             timezone=timezone,
         )
 
@@ -84,4 +89,5 @@ class Settings:
             log_level="CRITICAL",
             host="127.0.0.1",
             port=8780,
+            encryption_key=None,
         )