feat: harden account security flows

app/config.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import os
 import secrets
+from datetime import timedelta
 from pathlib import Path
 
 from dotenv import dotenv_values
@@ -45,20 +46,33 @@ def app_env() -> str:
     return os.environ.get("APP_ENV", "development").strip().lower() or "development"
 
 
+def database_url() -> str:
+    """返回数据库地址，并将相对 SQLite 路径固定到项目目录。"""
+    value = os.environ.get("DATABASE_URL", "").strip()
+    if not value:
+        return f"sqlite:///{DATA_DIR / 'pipe_survival_0331.db'}"
+    prefix = "sqlite:///"
+    if value.startswith(prefix) and not value.startswith("sqlite:////"):
+        return f"sqlite:///{BASE_DIR / value.removeprefix(prefix)}"
+    return value
+
+
 class Config:
     APP_ENV = app_env()
     DEBUG = env_bool("DEBUG", APP_ENV in {"dev", "development", "local"})
     SECRET_KEY = os.environ.get("SECRET_KEY") or secrets.token_hex(32)
     SECRET_KEY_GENERATED = not bool(os.environ.get("SECRET_KEY"))
-    SQLALCHEMY_DATABASE_URI = os.environ.get(
-        "DATABASE_URL",
-        f"sqlite:///{DATA_DIR / 'pipe_survival_0331.db'}",
-    )
+    SQLALCHEMY_DATABASE_URI = database_url()
     SQLALCHEMY_TRACK_MODIFICATIONS = False
     MAX_CONTENT_LENGTH = env_int("MAX_UPLOAD_BYTES", 16 * 1024 * 1024)
     SESSION_COOKIE_HTTPONLY = True
     SESSION_COOKIE_SAMESITE = "Lax"
     SESSION_COOKIE_SECURE = env_bool("SESSION_COOKIE_SECURE", APP_ENV == "production")
+    # 仅在用户主动勾选“保持登录状态”时使用。
+    REMEMBER_COOKIE_DURATION = timedelta(days=7)
+    REMEMBER_COOKIE_HTTPONLY = True
+    REMEMBER_COOKIE_SECURE = SESSION_COOKIE_SECURE
+    REMEMBER_COOKIE_SAMESITE = "Lax"
     FUSION_MODEL_CORE_DIR = os.environ.get(
         "FUSION_MODEL_CORE_DIR",
         str(BASE_DIR / "model_core"),
@@ -74,6 +88,8 @@ class Config:
     EMAIL_CODE_MINUTES = env_int("EMAIL_CODE_MINUTES", 10)
     EMAIL_CODE_RESEND_SECONDS = env_int("EMAIL_CODE_RESEND_SECONDS", 60)
     EMAIL_CODE_MAX_ATTEMPTS = env_int("EMAIL_CODE_MAX_ATTEMPTS", 5)
+    # 邮箱验证码通过后，可用于高风险操作的短时授权。
+    FRESH_AUTH_MINUTES = env_int("FRESH_AUTH_MINUTES", 5)
     TRUSTED_DEVICE_DAYS = env_int("TRUSTED_DEVICE_DAYS", 30)