fix(trae): 回调基址判定用 ipaddress，避开 bandit B104 误报

'0.0.0.0' 字面量在 bandit 眼里是「绑定全网卡」（B104），这里只是主机
字符串比对。改为 ipaddress 判定回环 / 未指定地址，同时把 ::（IPv6 通配）
也纳入，测试补 localhost 与非回环 IP 两条分支。

Author: RobbsLuo

src/api/admin_auth.py

@@ -7,6 +7,7 @@
 from __future__ import annotations
 
 import inspect
+import ipaddress
 import time
 
 from fastapi import APIRouter, Depends, Request
@@ -39,7 +40,7 @@
 # 浏览器打不开的基址主机：回环与通配监听。PUBLIC_BASE_URL 默认值就是
 # 127.0.0.1:8000，远程/容器部署忘了改时，回调会跳到**用户自己这台机器**，
 # 浏览器既回不到服务也不报错（issue #21）。
-_UNREACHABLE_BASE_HOSTS = frozenset({"127.0.0.1", "localhost", "::1", "0.0.0.0"})
+_LOCALHOST_NAMES = frozenset({"localhost"})
 
 
 def _host_of(authority: str) -> str:
@@ -50,6 +51,17 @@ def _host_of(authority: str) -> str:
     return text.split(":", 1)[0].lower()
 
 
+def _browser_cannot_reach(host: str) -> bool:
+    """回环 / 通配监听：浏览器打开它到不了本服务（或到不了发请求的那个人）。"""
+    if host in _LOCALHOST_NAMES:
+        return True
+    try:
+        address = ipaddress.ip_address(host)
+    except ValueError:          # 普通域名 / 无效字面量：按可达处理
+        return False
+    return address.is_loopback or address.is_unspecified
+
+
 def _request_origin(request: Request) -> str:
     """当前请求的浏览器 origin（采信反代/隧道的 X-Forwarded-Proto）。"""
     proto = request.headers.get("x-forwarded-proto", "").split(",", 1)[0].strip().lower()
@@ -73,9 +85,9 @@ def resolve_public_callback_url(settings: Settings,
     `host_allowed` 白名单，故这里采信 Host 头不会放大攻击面。
     """
     base = settings.public_base_url.rstrip("/")
-    if request is not None and _host_of(base) in _UNREACHABLE_BASE_HOSTS:
+    if request is not None and _browser_cannot_reach(_host_of(base)):
         request_host = _host_of(request.headers.get("host", "") or request.url.netloc)
-        if request_host and request_host not in _UNREACHABLE_BASE_HOSTS:
+        if request_host and not _browser_cannot_reach(request_host):
             base = _request_origin(request).rstrip("/")
     return base + "/authorize"
 

tests/api/test_authorize.py

@@ -400,6 +400,11 @@ def test_resolve_callback_url_uses_request_origin_for_unreachable_base():
                         PUBLIC_BASE_URL="http://0.0.0.0:8000")
     assert resolve_public_callback_url(wildcard, _request("10.0.0.2:8000")) == \
         "http://10.0.0.2:8000/authorize"
+    # localhost 字面量同理
+    named = Settings(_env_file=None, APP_SECRET=SECRET,
+                     PUBLIC_BASE_URL="http://localhost:8000")
+    assert resolve_public_callback_url(named, _request("10.0.0.2:8000")) == \
+        "http://10.0.0.2:8000/authorize"
 
 
 def test_resolve_callback_url_keeps_configured_base():
@@ -416,6 +421,11 @@ def test_resolve_callback_url_keeps_configured_base():
                         PUBLIC_BASE_URL="https://gw.example")
     assert resolve_public_callback_url(explicit, _request("192.168.1.5:8000")) == \
         "https://gw.example/authorize"
+    # 非回环 IP 基址：本来就是浏览器可达的，不为请求 origin 让路
+    lan_base = Settings(_env_file=None, APP_SECRET=SECRET,
+                        PUBLIC_BASE_URL="http://10.0.0.9:8000")
+    assert resolve_public_callback_url(lan_base, _request("192.168.1.5:8000")) == \
+        "http://10.0.0.9:8000/authorize"
 
 
 def _mock_trae() -> TraeProvider: