modify: 授权

config.toml

@@ -11,7 +11,7 @@ upload_path = "uploads"
 json5_path = "./config/zenoh_config.json5"
 
 [cache]
-backend = "sqlite"            # "sqlite"（默认，本机共享） | "redis"（跨主机）
+backend = "sqlite" # "sqlite"（默认，本机共享） | "redis"（跨主机）
 # backend = "redis"
 # path = "./cache_data/cache.db"
 
@@ -38,6 +38,22 @@ redis_prefix = "chongming:"
 algorithm = "HS256"
 secret_key = "your-secret-key-change-in-production"
 
+[license]
+# 机器码授权（插件白名单）。未授权插件不加载、不注册路由、管理接口禁止操作。
+#
+# enabled 只在**非打包态**（uv run serve / 测试）决定是否执行拒绝：打包产物
+# （Nuitka/PyInstaller）恒为强制校验 —— 部署目录的 config.toml 是明文可写的，
+# 若以配置开关为准，改一行就能绕过授权。
+enabled = false
+# 授权文件路径（相对网关工作目录）
+path = "license.lic"
+# 厂商公钥（base64 裸 32 字节，或 PEM）。公钥可明文放置：换公钥只会验签失败，
+# 无法据以伪造授权（伪造需要厂商私钥）。构建时由 build.py 从
+# CHONGMING_LICENSE_PUBKEY / license_public.key 注入。
+public_key = ""
+# 指纹命中阈值（N-of-M）。4 个可信来源下取 3 表示容忍单块网卡或单颗 eMMC 更换。
+min_match = 3
+
 [development]
 debug = true
 env = "development"
@@ -102,7 +118,7 @@ config_path = "./config/workers/config.toml"
 
 [pyinstaller_build_import]
 base = [
-  "utils", # public 骨架
+  "utils",                                            # public 骨架
   "utils.launch",
   "utils.config",
   "zenoh",
@@ -112,13 +128,16 @@ base = [
   "chongming_worker.routes_publisher",
   "chongming_request",
   "chongming_auth",
+  "chongming_license",                                # 机器码授权（指纹采集/验签/判定）
+  "cryptography",                                     # Ed25519 验签
+  "cryptography.hazmat.primitives.asymmetric.ed25519",
   "server",
-  "module_bank", # 模块化打包工具
+  "module_bank",                                      # 模块化打包工具
   "sqlite_vfs",
   "sqlite_vfs.core",
   "sqlite_vfs.contrib",
   "sqlite_vfs.contrib.fastapi_static",
-  "fastapi", # web 应用依赖
+  "fastapi",                                          # web 应用依赖
   "fastapi.staticfiles",
   "fastapi.middleware.cors",
   "fastapi.middleware.gzip",
@@ -149,16 +168,20 @@ base = [
   "aiofiles",
   "openai",
 ]
-linux = [
-  "gunicorn.glogging",
-  "gunicorn.app",
-  "gunicorn.app.wsgiapp",
-]
+linux = ["gunicorn.glogging", "gunicorn.app", "gunicorn.app.wsgiapp"]
 windows = []
 
 [production.module_system]
 path = [
-  ["resources/app.mbank", "src/chongming/app", "app"],
-  ["resources/plugins.mbank", "src/plugins", "plugins"],
+  [
+    "resources/app.mbank",
+    "src/chongming/app",
+    "app",
+  ],
+  [
+    "resources/plugins.mbank",
+    "src/plugins",
+    "plugins",
+  ],
 ]
 type = "module-bank"