系统架构
浏览器边界
紫鸟插件用于识别当前已登录店铺的页面上下文和执行经批准的本地动作。插件不读取 TikTok 登录密码，也不接收官方应用密钥。
服务端边界
FastAPI 服务处理会话、规则、审计和官方 API 调用。生产环境由 Caddy 提供 HTTPS，业务服务不直接暴露公网端口。
数据层
应用数据使用持久化数据库和独立备份目录。Redis 和 PostgreSQL 服务位于私有容器网络，凭据从生产环境变量注入。
权限边界
管理员权限、官方集成状态、写入安全开关和规则级限制分别检查，单个开关不能绕过完整执行链。
OAuth 与凭据
- 用户在 TikTok 官方授权页面登录和选择账户。
- 回调地址固定为
https://gmv-auth.tbsapi.com/api/integrations/tiktok_official/oauth/callback - 应用密钥和令牌写入服务端加密保险库，不写入网页、本地存储或浏览器插件。
- OAuth state 与当前管理员会话绑定，并校验回调状态。
- 用户可以断开授权，清除令牌并停止后续官方调用。
广告写入控制
官方写入和插件写入是两个独立安全开关，默认均为关闭。执行前还会检查：数据新鲜度、规则冷却、预算变更比例、每日店铺消耗上限、单次动作数量和紧急停止状态。
官方 API 尚未获批，官方写入保持关闭。演示和规则验收使用预演模式，不修改真实广告计划。
运行安全
- HTTPS 强制传输并启用 HSTS、内容类型保护和点击劫持防护。
- 本产品密码经过强哈希保存，会话 Cookie 在生产环境使用 Secure 和 HttpOnly。
- 写入动作使用幂等键，减少重试造成的重复修改。
- 审计记录包含操作人、对象、模式、结果和前后值。
- 发生异常时可以立即启用全局紧急停止。
安全问题报告
Architecture
Browser boundary
The extension identifies the current signed-in shop context and performs approved local actions. It does not read TikTok passwords or receive official app secrets.
Server boundary
FastAPI handles sessions, rules, audit and official API calls. Caddy terminates production HTTPS, and the application port is not exposed directly to the internet.
Data layer
Application data uses persistent storage and a separate backup directory. Redis and PostgreSQL run on a private container network, with secrets injected through production environment variables.
Permission boundary
Administrator role, official integration state, write safety switches and rule-level constraints are evaluated separately. One switch cannot bypass the execution chain.
OAuth and credentials
- Users sign in and select accounts on TikTok's official authorization page.
- The callback is fixed to
https://gmv-auth.tbsapi.com/api/integrations/tiktok_official/oauth/callback - App secrets and tokens remain in an encrypted server-side vault, never in page storage or the extension.
- OAuth state is bound to the current administrator session and validated on callback.
- Users can disconnect authorization, clear tokens and stop future official calls.
Advertising write controls
Official writes and extension writes are separate safety switches, both off by default. Execution also validates data freshness, cooldowns, budget-change percentage, daily shop spend cap, action-count limit and emergency-stop state.
The official API is not yet approved, so official writes remain disabled. Demonstrations and rule validation use preview mode and do not modify live campaigns.
Operational security
- HTTPS is enforced with HSTS, content-type protection and clickjacking protection.
- Product passwords use strong hashing. Production session cookies use Secure and HttpOnly.
- Write actions use idempotency keys to reduce duplicate changes during retries.
- Audit records include actor, target, mode, result and before and after values.
- A global emergency stop can halt actions when an anomaly occurs.