chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912)

backend/.env.example

@@ -1,6 +1,6 @@
 # 管理会计OS — 数据库配置
 CMA_DB_USER=cma_user
-CMA_DB_PASS=cma_pass_2026
+CMA_DB_PASS=__CHANGE_ME__
 CMA_DB_HOST=127.0.0.1
 CMA_DB_PORT=3306
 CMA_DB_NAME=cma

backend/app/database.py

@@ -7,8 +7,16 @@ import logging
 
 logger = logging.getLogger("cma")
 
-DB_USER = os.getenv("CMA_DB_USER", "cma_user")
+# 2026-09-12 库访问治理（wecom-ops）：统一从 backend/.env 读取凭据，
-DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
+# 定时任务/脚本与 8010 API 同源（此前脚本吃硬编码 fallback，与 .env 不一致）。
+try:
+    from dotenv import load_dotenv as _load_dotenv
+    _load_dotenv(os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".env"))
+except Exception:  # dotenv 缺失/文件不可读时不影响启动，由下方环境变量兜底
+    pass
+
+DB_USER = os.getenv("CMA_DB_USER", "cma_reader")   # 兜底=只读账号（最小权限）
+DB_PASS = os.getenv("CMA_DB_PASS", "")             # 无明文兜底：缺失即连接失败并报错
 DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
 DB_PORT = os.getenv("CMA_DB_PORT", "3306")
 DB_NAME = os.getenv("CMA_DB_NAME", "cma")

backend/scripts/clean_kpi_data_governance.py

@@ -29,10 +29,21 @@ CMA 数据治理 P0-2 数据清洗脚本（2026-08-15）
 """
 import pymysql
 
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
 
 def main():
-    conn = pymysql.connect(host="127.0.0.1", port=3306, user="cma_user",
+    conn = pymysql.connect(host="127.0.0.1", port=3306, user=_CMA_DB_USER,
-                           password="cma_pass_2026", database="cma", charset="utf8mb4")
+                           password=_CMA_DB_PASS, database="cma", charset="utf8mb4")
     cur = conn.cursor(pymysql.cursors.DictCursor)
 
     def q(sql, args=None):

backend/scripts/cleanup_kpi_encoding.py

@@ -3,11 +3,21 @@ import pymysql
 import os
 import logging
 
+# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
+import os
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env')
+except Exception:
+    pass
+if not os.getenv('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("encoding-cleanup")
 
 DB_USER = os.getenv("CMA_DB_USER", "cma_user")
-DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
+DB_PASS = os.environ["CMA_DB_PASS"]
 DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
 DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
 DB_NAME = os.getenv("CMA_DB_NAME", "cma")

backend/scripts/fix_kpi_governance.py

@@ -8,6 +8,17 @@
 import sys
 import pymysql
 
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
 PLACEHOLDERS = ("待补充", "待指定", "待完善", "待定", "暂无", "TBD", "tbd", "-", "--", "N/A", "n/a")
 DIM_PREFIX = {"finance": "F", "customer": "C", "process": "P", "learning": "L"}
 DIM_FORMULA = {
@@ -82,8 +93,8 @@ def audit(kpis):
 
 def main():
     apply = "--apply" in sys.argv
-    conn = pymysql.connect(host="127.0.0.1", port=3306, user="cma_user",
+    conn = pymysql.connect(host="127.0.0.1", port=3306, user=_CMA_DB_USER,
-                           password="cma_pass_2026", database="cma", charset="utf8mb4")
+                           password=_CMA_DB_PASS, database="cma", charset="utf8mb4")
     cur = conn.cursor(pymysql.cursors.DictCursor)
     cur.execute("SELECT * FROM kpi_definitions WHERE status='active'")
     kpis = cur.fetchall()

backend/scripts/import_cma_knowledge.py

@@ -2,7 +2,18 @@
 """将CMA战略地图完整文档导入知识库"""
 import pymysql, re
 
-DB = dict(host='127.0.0.1', port=3306, user='cma_user', password='cma_pass_2026', database='cma', charset='utf8mb4')
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
+DB = dict(host='127.0.0.1', port=3306, user=_CMA_DB_USER, password=_CMA_DB_PASS, database='cma', charset='utf8mb4')
 
 DOC = "/root/CMA_Strategy_Map_完整分析.md"
 

backend/scripts/import_product_sales.py

@@ -6,11 +6,22 @@ import os
 import re
 import pymysql
 
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
 # DB连接
 DB_CONFIG = {
     'host': '127.0.0.1',
-    'user': 'cma_user',
+    'user': _CMA_DB_USER,
-    'password': 'cma_pass_2026',
+    'password': _CMA_DB_PASS,
     'database': 'cma',
     'charset': 'utf8mb4',
 }

backend/scripts/migrate_data_governance.py

@@ -3,11 +3,21 @@ import pymysql
 import os
 import logging
 
+# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
+import os
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env')
+except Exception:
+    pass
+if not os.getenv('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("data-governance")
 
 DB_USER = os.getenv("CMA_DB_USER", "cma_user")
-DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
+DB_PASS = os.environ["CMA_DB_PASS"]
 DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
 DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
 DB_NAME = os.getenv("CMA_DB_NAME", "cma")

backend/scripts/seed_finance_bot_kpis.py

@@ -7,8 +7,18 @@ import os
 import sys
 from datetime import datetime
 
+# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
+import os
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env')
+except Exception:
+    pass
+if not os.getenv('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 DB_USER = os.getenv("CMA_DB_USER", "cma_user")
-DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
+DB_PASS = os.environ["CMA_DB_PASS"]
 DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
 DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
 DB_NAME = os.getenv("CMA_DB_NAME", "cma")

backend/scripts/verify_dashboard_isolation.py

@@ -5,6 +5,16 @@ import json
 import urllib.request
 import pymysql
 
+# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
+import os
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env')
+except Exception:
+    pass
+if not os.getenv('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 BASE = "http://127.0.0.1:8010"
 
 
@@ -39,7 +49,9 @@ def main():
     reminders = d.get("reminders", [])
     print(f"2. my-dashboard OK: action_plans={len(plans)} 条, reminders={len(reminders)} 条")
 
-    conn = pymysql.connect(host="127.0.0.1", user="cma_user", password="cma_pass_2026",
+    # 账号与口令同源（backend/.env）——硬编码 cma_user + 应用口令会账号/口令错配
+    conn = pymysql.connect(host="127.0.0.1", user=os.getenv("CMA_DB_USER", "cma_user"),
+                           password=os.environ.get("CMA_DB_PASS", ""),
                            database="cma", charset="utf8mb4")
     cur = conn.cursor()
 

backend/scripts/verify_knowledge_partition_e2e.py

@@ -13,12 +13,15 @@ with open('/root/cma-management/backend/.env') as f:
             k, v = line.split('=', 1)
             env[k.strip()] = v.strip().strip('"').strip("'")
 
+if not env.get('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 import pymysql
 conn = pymysql.connect(
     host=env.get('CMA_DB_HOST', '127.0.0.1'),
     port=int(env.get('CMA_DB_PORT', '3306')),
     user=env.get('CMA_DB_USER', 'cma_user'),
-    password=env.get('CMA_DB_PASS', 'cma_pass_2026'),
+    password=env.get('CMA_DB_PASS'),
     database=env.get('CMA_DB_NAME', 'cma'),
     charset='utf8mb4',
 )

check.sh

@@ -23,7 +23,12 @@ fi
 
 # 3. 数据库
 echo "[3] 数据库"
-if mysql -ucma_user -pcma_pass_2026 -h127.0.0.1 cma -e "SELECT 1;" &>/dev/null; then
+# 2026-09-12 凭据治理：账号必须与口令同源（backend/.env 已切 cma_api），禁止硬编码账号名
+CMA_DB_USER="${CMA_DB_USER:-$(grep -m1 '^CMA_DB_USER=' /root/cma-management/backend/.env 2>/dev/null | cut -d= -f2- | tr -d '"')}"
+CMA_DB_PASS="${CMA_DB_PASS:-$(grep -m1 '^CMA_DB_PASS=' /root/cma-management/backend/.env 2>/dev/null | cut -d= -f2- | tr -d '"')}"
+if [ -z "$CMA_DB_USER" ] || [ -z "$CMA_DB_PASS" ]; then
+  echo "    ! 未取到 CMA_DB_USER/PASS（2026-09-12 凭据治理：无明文兜底），跳过直连自检"
+elif mysql -u"$CMA_DB_USER" -p"$CMA_DB_PASS" -h127.0.0.1 cma -e "SELECT 1;" &>/dev/null; then
   echo "    ✓ MariaDB 连接正常"
 else
   echo "    ✗ MariaDB 连接失败"

scripts/sync_wecom_users.py

@@ -12,12 +12,23 @@ import urllib.request
 import pymysql
 import hashlib
 
+# 2026-09-12 库访问治理（ops）：口令改从 .env 读取，清除硬编码
+import os as _os_gov
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env', override=False)
+except Exception:
+    pass
+_CMA_DB_PASS = _os_gov.getenv('CMA_DB_PASS', '')
+_CMA_DB_USER = _os_gov.getenv('CMA_DB_USER', '')
+_CMA_DB_HOST = _os_gov.getenv('CMA_DB_HOST', '127.0.0.1')
+
 # ==== 配置 ====
 MCP_URL = "http://127.0.0.1:18900/call"
 DB_HOST = "127.0.0.1"
 DB_PORT = 3306
-DB_USER = "cma_user"
+DB_USER = _CMA_DB_USER
-DB_PASS = "cma_pass_2026"
+DB_PASS = _CMA_DB_PASS
 DB_NAME = "cma"
 DEFAULT_PASSWORD = "admin123"