fix+perf: SQLite连接busy_timeout修复并发锁/静态版本号缓存/删除资产批量清理/安全检查最新记录子查询修正/AI余额与SSL探测并发化/密钥常量时间比较

app/core/security.py

@@ -5,6 +5,7 @@
 - 若已配置，则要求请求头携带正确的 X-API-Key，否则返回 401。
 """
 
+import hmac
 from typing import Optional
 
 from fastapi import Header, HTTPException, status
@@ -12,13 +13,20 @@ from fastapi import Header, HTTPException, status
 from app.core.config import settings
 
 
+def _key_matches(provided: Optional[str], expected: str) -> bool:
+    """常量时间比较密钥，避免时序旁路泄露密钥长度/前缀信息"""
+    if not provided:
+        return False
+    return hmac.compare_digest(provided.encode(), expected.encode())
+
+
 async def require_api_key(
     x_api_key: Optional[str] = Header(default=None, alias="X-API-Key"),
 ) -> None:
     """校验 API Key（可选启用）"""
     if not settings.API_KEY:
         return
-    if x_api_key != settings.API_KEY:
+    if not _key_matches(x_api_key, settings.API_KEY):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="API Key 无效或缺失",
@@ -31,7 +39,7 @@ async def require_agent_key(
     """校验 Agent 上报 Key（可选启用）"""
     if not settings.AGENT_KEY:
         return
-    if x_agent_key != settings.AGENT_KEY:
+    if not _key_matches(x_agent_key, settings.AGENT_KEY):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Agent Key 无效或缺失",