security: memos token 改由 secrets.json 读取, crontab 不再明文

scripts/sync_cards.py

@@ -20,8 +20,22 @@ BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 CARDS_DIR = os.path.join(BASE_DIR, "cards")
 GIT_DIR = BASE_DIR
 
-MEMOS_URL = os.environ.get("MEMOS_URL", "http://localhost:5230")
+def _load_memos_config():
-MEMOS_TOKEN = os.environ.get("MEMOS_ACCESS_TOKEN", "")
+    """优先环境变量, 其次 secrets/secrets.json —— 令牌不进 crontab。"""
+    url = os.environ.get("MEMOS_URL")
+    token = os.environ.get("MEMOS_ACCESS_TOKEN")
+    if url and token:
+        return url, token
+    try:
+        import json
+        with open(os.path.join(BASE_DIR, "secrets", "secrets.json"), encoding="utf-8") as f:
+            s = json.load(f)
+    except Exception:
+        s = {}
+    return url or s.get("memos_url", "http://localhost:5230"), token or s.get("memos_token", "")
+
+
+MEMOS_URL, MEMOS_TOKEN = _load_memos_config()
 
 TZ_BEIJING = timezone(timedelta(hours=8))