From 0993a721b63215bad3578bae70ced5e75c9968dd Mon Sep 17 00:00:00 2001
From: Kris <2893855659@qq.com>
Date: Tue, 30 Jun 2026 16:15:09 +0800
Subject: [PATCH] =?UTF-8?q?refactor(webhook):=20=E6=8A=BD=E7=A6=BB?=
 =?UTF-8?q?=E6=95=8F=E6=84=9F=E8=AF=B7=E6=B1=82=E5=A4=B4=E9=85=8D=E7=BD=AE?=
 =?UTF-8?q?=E5=88=B0=E5=85=AC=E5=85=B1=E6=A8=A1=E5=9D=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

将硬编码的敏感请求头集合替换为公共crypto模块的常量，统一维护敏感头配置，避免重复定义
---
 .../external_systems/webhook_router.py        | 20 ++++++-------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/backend/server/routers/external_systems/webhook_router.py b/backend/server/routers/external_systems/webhook_router.py
index 56402e26..345c182c 100644
--- a/backend/server/routers/external_systems/webhook_router.py
+++ b/backend/server/routers/external_systems/webhook_router.py
@@ -47,23 +47,12 @@ from yuxi.external_systems.use_cases.dto.webhook import (
     VerifySignatureInput,
 )
 from yuxi.storage.postgres.models_business import User
+from yuxi.utils.crypto import SENSITIVE_HTTP_HEADERS
 
 from server.utils.auth_middleware import get_admin_user, get_db, get_required_user
 
 webhook_router = APIRouter(prefix="/webhooks", tags=["external-systems-webhook"])
 
-# 敏感请求头白名单：``POST /events`` 透传 headers 到 WebhookEvent 持久化前必须剔除，
-# 对齐 ``ExternalWebhookEvent`` ORM 注释"payload/headers 由调用方在写入前完成脱敏"。
-_SENSITIVE_HEADERS = frozenset(
-    {
-        "authorization",
-        "cookie",
-        "set-cookie",
-        "x-api-key",
-        "x-auth-token",
-    }
-)
-
 
 def _extract_client_ip(request: Request) -> str | None:
     """提取客户端真实 IP，优先解析 ``x-forwarded-for``（与访问日志中间件一致）。"""
@@ -76,8 +65,11 @@ def _extract_client_ip(request: Request) -> str | None:
 
 
 def _sanitize_headers(headers: Any) -> dict[str, Any]:
-    """过滤敏感请求头，避免 ``authorization`` / ``cookie`` 等泄露到持久化层。"""
-    return {key: value for key, value in headers.items() if key.lower() not in _SENSITIVE_HEADERS}
+    """过滤敏感请求头，避免 ``authorization`` / ``cookie`` 等泄露到持久化层。
+
+    敏感字段集合统一引用 ``yuxi.utils.crypto.SENSITIVE_HTTP_HEADERS``（单一事实源）。
+    """
+    return {key: value for key, value in headers.items() if key.lower() not in SENSITIVE_HTTP_HEADERS}
 
 
 # ---------------- Request Schemas ----------------