加固后台管理安全

backend/cmd/api/main.go

@@ -12,6 +12,7 @@ import (
 	"hfb_sys/backend/internal/database"
 	"hfb_sys/backend/internal/jobs/ordertimeout"
 	"hfb_sys/backend/internal/logging"
+	"hfb_sys/backend/internal/modules/adminauth"
 	"hfb_sys/backend/internal/router"
 
 	"go.uber.org/zap"
@@ -45,6 +46,9 @@ func main() {
 	defer func() {
 		_ = logger.Sync()
 	}()
+	if err := cfg.ValidateProductionSecurity(); err != nil {
+		logger.Fatal("production security config invalid", zap.Error(err))
+	}
 
 	var deps router.Dependencies
 	db, err := database.OpenMySQL(cfg.MySQLDSN, cfg.Log.Level)
@@ -52,6 +56,14 @@ func main() {
 		logger.Warn("mysql unavailable; database-backed APIs will return 503", zap.Error(err))
 	} else {
 		deps.DB = db
+		if err := adminauth.BootstrapAdmin(context.Background(), db, adminauth.BootstrapConfig{
+			AppEnv:   cfg.AppEnv,
+			Username: cfg.BootstrapAdminUsername,
+			Password: cfg.BootstrapAdminPassword,
+			Nickname: cfg.BootstrapAdminNickname,
+		}); err != nil {
+			logger.Fatal("admin bootstrap failed", zap.Error(err))
+		}
 	}
 	redisClient, err := database.OpenRedis(context.Background(), database.RedisConfig{
 		Addr:     cfg.RedisAddr,