AI导哈

多租户银行API

一个基于FastAPI构建的生产级多租户金融API，提供认证、基于角色的访问控制、账户管理、转账、报告和审计日志功能。

  • by jash-CT
  • Python
  • 本地部署
  • 更新于
在 GitHub 查看 jash-CT/mcp-test

使用说明

Finance Application – Multi-Tenant Banking API

Production-ready multi-tenant finance API built with FastAPI, with authentication, role-based access, accounts, transfers, reporting, and audit logging. Generated and hardened with CT-MCP (CodeThreat) for OWASP-aligned secure coding.

Features

  • Multi-tenant: Tenants, users, and accounts isolated by tenant_id
  • Auth: JWT (exp/iat/nbf), bcrypt passwords, role-based access (admin, accountant, viewer)
  • Accounts: Create/close accounts, initial balance, transaction history
  • Transfers: Validated transfers with audit log and parameterized SQL
  • Reports: Balance sheet, income statement, CSV export
  • Security: Rate limiting, request size limit, Content-Type check, CORS allowlist, no wildcards
  • Audit: All state-changing actions logged (tenant, user, resource, details)

Security requirements (must set before run)

Variable Requirement
JWT_SECRET_KEY ≥ 32 chars, cryptographically random
API_KEY_SALT ≥ 16 chars, cryptographically random
ALLOWED_ORIGINS Comma-separated origins, no *
DB_PATH Path for SQLite DB (default: finance.db)

Generate secrets

python -c "import secrets; print('JWT_SECRET_KEY=' + secrets.token_urlsafe(64))"
python -c "import secrets; print('API_KEY_SALT=' + secrets.token_urlsafe(32))"

Installation

cd d:\mcppp
pip install -r requirements.txt

Configuration

Copy .env.example to .env and set the variables (or export them). Example for local dev:

# .env (do not use wildcard or weak secrets in production)
JWT_SECRET_KEY=your-at-least-32-char-secret-key-here-use-secrets-token_urlsafe
API_KEY_SALT=your-16-char-salt
ALLOWED_ORIGINS=http://127.0.0.1:8000,http://localhost:8000
DB_PATH=finance.db

Running

# From project root
python -m finance_app.main
# Or
uvicorn finance_app.main:app --host 127.0.0.1 --port 8000
  • Health: GET http://127.0.0.1:8000/health
  • Docs: http://127.0.0.1:8000/docs

API overview

Endpoint Auth Roles Description
GET /health No - Health check
POST /api/v1/auth/login No - Login (returns JWT)
POST /api/v1/tenants No - Create tenant (bootstrap)
POST /api/v1/users Bearer admin Create user
POST /api/v1/accounts Bearer admin, accountant Create account
DELETE /api/v1/accounts/{account_number} Bearer admin, accountant Close account (balance must be 0)
POST /api/v1/transfers Bearer admin, accountant Transfer between accounts
GET /api/v1/accounts Bearer all List accounts (paginated)
GET /api/v1/accounts/{account_number} Bearer all Get account
GET /api/v1/accounts/{account_number}/transactions Bearer all Transaction history (paginated)
GET /api/v1/reports/balance-sheet Bearer all Balance sheet
GET /api/v1/reports/income-statement Bearer all Income statement (optional date range)
GET /api/v1/reports/balance-sheet/export/csv Bearer admin, accountant Export balance sheet CSV

Security notes (from CT-MCP)

  • JWT validated with exp/iat/nbf and configurable clock skew; no none algorithm.
  • Rate limiting per client (IP), thread-safe, with periodic cleanup.
  • Request size and Content-Type enforced before body parsing.
  • Parameterized SQL only; bcrypt for passwords; audit log for state changes.
  • Pagination capped (page ≤ 1000, page_size ≤ 100).
  • Errors return generic messages; details only in server logs.
  • For production scale, consider PostgreSQL and connection pooling; rotate JWT_SECRET_KEY periodically.

Project layout

d:\mcppp\
  finance_app/
    main.py       # FastAPI app, auth, DB, routes, middleware
  requirements.txt
  .env.example
  README.md

相关 MCP