From c4c2b44434b2d8d3e7163504f611372100ad2bf5 Mon Sep 17 00:00:00 2001
From: zwt13703 <zwt13703@gmail.com>
Date: Mon, 6 Jul 2026 17:03:55 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20Fernet=20=E5=AF=86=E9=92=A5=E6=B4=BE?=
 =?UTF-8?q?=E7=94=9F=E4=BD=BF=E7=94=A8=20SHA256=20=E5=93=88=E5=B8=8C?=
 =?UTF-8?q?=E7=94=9F=E6=88=90=E5=90=88=E6=B3=95=2032=20=E5=AD=97=E8=8A=82?=
 =?UTF-8?q?=E5=AF=86=E9=92=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 原因: key.ljust(44, b'=') 不产生合法的 Fernet 密钥
- 修复: SHA256(SECRET_KEY) → base64url 编码 → 有效 Fernet key
---
 backend/app/core/security.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/backend/app/core/security.py b/backend/app/core/security.py
index 5f5294c..877c52a 100644
--- a/backend/app/core/security.py
+++ b/backend/app/core/security.py
@@ -1,11 +1,17 @@
+import base64
+import hashlib
 from cryptography.fernet import Fernet
 from app.core.config import get_settings
 
 
+def _derive_fernet_key(secret: str) -> bytes:
+    digest = hashlib.sha256(secret.encode("utf-8")).digest()
+    return base64.urlsafe_b64encode(digest)
+
+
 def _get_fernet() -> Fernet:
     settings = get_settings()
-    key = settings.SECRET_KEY.encode("utf-8")
-    key = key.ljust(44, b"=")[:44]
+    key = _derive_fernet_key(settings.SECRET_KEY)
     return Fernet(key)