Update app.py

app.py

@@ -1,15 +1,77 @@
 import os
+import time
+import uuid
+from datetime import timedelta
 from pydub import AudioSegment
 from openai import OpenAI
 import gradio as gr
 
 # ========================
-# 🔐 使用者設定區（安全）
+# 🔐 環境變數設定
 # ========================
 PASSWORD = os.getenv("APP_PASSWORD", "defaultpass")
-MAX_SIZE = 25 * 1024 * 1024
+MAX_SIZE = 25 * 1024 * 1024  # 25 MB 限制
 client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))
 
+# ========================
+# ⚔️ 防暴力破解機制
+# ========================
+MAX_FAILED_IN_WINDOW = 10           # 24小時內最多10次
+WINDOW_SECONDS = 24 * 3600
+LOCK_DURATION_SECONDS = 24 * 3600   # 鎖24小時
+SHORT_BURST_LIMIT = 5               # 一分鐘內最多5次
+SHORT_BURST_SECONDS = 60
+attempts = {}   # {session_id: [timestamps]}
+locked = {}     # {session_id: unlock_time}
+
+
+def _now():
+    return int(time.time())
+
+
+def prune_old_attempts(session_id):
+    if session_id not in attempts:
+        return
+    cutoff = _now() - WINDOW_SECONDS
+    attempts[session_id] = [t for t in attempts[session_id] if t >= cutoff]
+    if not attempts[session_id]:
+        del attempts[session_id]
+
+
+def check_lock(session_id):
+    if session_id in locked:
+        unlock = locked[session_id]
+        if _now() < unlock:
+            remain = unlock - _now()
+            return True, f"🔒 已被鎖定，請 {remain // 60} 分鐘後再試。"
+        else:
+            del locked[session_id]
+            attempts.pop(session_id, None)
+    prune_old_attempts(session_id)
+    cnt = len(attempts.get(session_id, []))
+    if cnt >= MAX_FAILED_IN_WINDOW:
+        locked[session_id] = _now() + LOCK_DURATION_SECONDS
+        return True, f"🔒 嘗試過多，已鎖定 24 小時。"
+    return False, ""
+
+
+def record_failed_attempt(session_id):
+    now = _now()
+    attempts.setdefault(session_id, []).append(now)
+    prune_old_attempts(session_id)
+    cnt = len(attempts.get(session_id, []))
+    recent_cutoff = now - SHORT_BURST_SECONDS
+    recent = [t for t in attempts[session_id] if t >= recent_cutoff]
+    if len(recent) >= SHORT_BURST_LIMIT:
+        locked[session_id] = now + 300  # 鎖5分鐘
+        return cnt, "⚠️ 多次快速嘗試，暫時鎖定5分鐘。"
+    return cnt, ""
+
+
+def clear_attempts(session_id):
+    attempts.pop(session_id, None)
+    locked.pop(session_id, None)
+
 # ========================
 # 🔊 音訊分割
 # ========================
@@ -31,14 +93,9 @@ def split_audio_if_needed(input_path):
     return chunk_files
 
 # ========================
-# 🎧 轉錄 + 摘要
+# 🎧 轉錄與摘要
 # ========================
-def transcribe_and_summarize(password, file, model_choice):
-    if password != PASSWORD:
-        return "❌ 密碼錯誤，請重新輸入。", "", ""
-    if not file:
-        return "請上傳音訊檔。", "", ""
-
+def transcribe_core(file, model_choice):
     chunks = split_audio_if_needed(file)
     transcripts = []
     for idx, f in enumerate(chunks, 1):
@@ -50,27 +107,42 @@ def transcribe_and_summarize(password, file, model_choice):
             )
         transcripts.append(text)
     full_text = "\n".join(transcripts)
-
     response = client.chat.completions.create(
         model="gpt-4o-mini",
         messages=[
             {"role": "system", "content": "你是一位精準且擅長摘要的助手。"},
-            {"role": "user", "content": f"請用繁體中文摘要以下內容：\n{full_text}"}
+            {"role": "user", "content": "請用繁體中文摘要以下內容：\n" + full_text}
         ],
         temperature=0.4,
     )
     summary = response.choices[0].message.content.strip()
-    return full_text, summary, "✅ 已完成轉錄與摘要"
+    return full_text, summary
+
+
+def transcribe_with_password(session_id, password, file, model_choice):
+    locked_flag, msg = check_lock(session_id)
+    if locked_flag:
+        return msg, "", "", ""
+    if password != PASSWORD:
+        cnt, msg2 = record_failed_attempt(session_id)
+        if msg2:
+            return msg2, "", "", ""
+        return f"密碼錯誤（第 {cnt} 次）", "", "", ""
+    if not file:
+        return "請上傳音訊檔。", "", "", ""
+    clear_attempts(session_id)
+    full_text, summary = transcribe_core(file, model_choice)
+    return "✅ 成功轉錄與摘要完成", full_text, summary, ""
 
 # ========================
 # 💬 進一步問 AI
 # ========================
 def ask_about_transcript(full_text, user_question):
     if not full_text.strip():
-        return "⚠️ 尚未有轉錄內容，請先上傳音訊。"
+        return "⚠️ 尚未有轉錄內容。"
     if not user_question.strip():
-        return "請輸入想詢問的問題。"
-    prompt = f"以下是語音轉錄的完整內容：\n\n{full_text}\n\n使用者的問題是：{user_question}\n\n請以繁體中文回答。"
+        return "請輸入問題。"
+    prompt = f"以下是轉錄內容：\n{full_text}\n\n使用者問：{user_question}\n請用繁體中文回答。"
     response = client.chat.completions.create(
         model="gpt-4o-mini",
         messages=[{"role": "user", "content": prompt}],
@@ -81,42 +153,53 @@ def ask_about_transcript(full_text, user_question):
 # ========================
 # 🌐 Gradio 介面
 # ========================
-with gr.Blocks(theme=gr.themes.Soft(), css=".gr-button {font-size: 16px;} .copy-btn {background: #e0e0e0;}") as demo:
-    gr.Markdown("## 🎧 語音轉錄與摘要工具 (受密碼保護)")
-    gr.Markdown("上傳音訊後，自動轉錄文字並生成摘要。可進一步詢問 AI 關於對話內容。")
+with gr.Blocks(theme=gr.themes.Soft()) as demo:
+    gr.Markdown("## 🎧 語音轉錄與摘要工具（含防暴力破解）")
+
+    session_id_box = gr.Textbox(value="", visible=False)
+    init_session_js = """
+    () => {
+        let sid = localStorage.getItem('my_session_id');
+        if (!sid) {
+            sid = crypto.randomUUID ? crypto.randomUUID() :
+                  (Date.now().toString(36) + Math.random().toString(36).slice(2));
+            localStorage.setItem('my_session_id', sid);
+        }
+        return sid;
+    }
+    """
+    session_id_box.load(_js=init_session_js)
 
     with gr.Row():
-        password_input = gr.Textbox(label="輸入密碼", type="password", placeholder="請輸入授權密碼")
+        password_input = gr.Textbox(label="輸入密碼", type="password")
         model_choice = gr.Dropdown(
             choices=["whisper-1", "gpt-4o-mini-transcribe"],
             value="whisper-1",
             label="選擇轉錄模型"
         )
 
-    audio_input = gr.Audio(type="filepath", label="上傳音訊檔 (.m4a, .aac, .wav)")
+    audio_input = gr.Audio(type="filepath", label="上傳音訊 (.m4a, .aac, .wav)")
     transcribe_btn = gr.Button("開始轉錄與摘要 🚀")
 
     status_box = gr.Textbox(label="狀態", interactive=False)
-
     with gr.Row():
         transcript_box = gr.Textbox(label="完整轉錄文字", lines=10)
-        copy_transcript = gr.Button("📋 複製", elem_classes="copy-btn")
+        copy_transcript = gr.Button("📋 複製")
 
     with gr.Row():
         summary_box = gr.Textbox(label="摘要結果", lines=10)
-        copy_summary = gr.Button("📋 複製", elem_classes="copy-btn")
+        copy_summary = gr.Button("📋 複製")
 
     with gr.Accordion("💬 進一步問 AI", open=False):
-        user_question = gr.Textbox(label="輸入你的問題（例如：我該如何回應？）", lines=2)
+        user_question = gr.Textbox(label="輸入你的問題", lines=2)
         ask_btn = gr.Button("詢問 AI 🤔")
         ai_reply = gr.Textbox(label="AI 回覆", lines=6)
-        copy_reply = gr.Button("📋 複製 AI 回覆", elem_classes="copy-btn")
+        copy_reply = gr.Button("📋 複製")
 
-    # 事件綁定
     transcribe_btn.click(
-        fn=transcribe_and_summarize,
-        inputs=[password_input, audio_input, model_choice],
-        outputs=[transcript_box, summary_box, status_box]
+        fn=transcribe_with_password,
+        inputs=[session_id_box, password_input, audio_input, model_choice],
+        outputs=[status_box, transcript_box, summary_box, gr.Textbox(visible=False)]
     )
 
     ask_btn.click(
@@ -125,7 +208,6 @@ with gr.Blocks(theme=gr.themes.Soft(), css=".gr-button {font-size: 16px;} .copy-
         outputs=[ai_reply]
     )
 
-    # 前端 JS 複製功能
     copy_js = """
     async (text) => {
         try {