wangsli
1855a82011
- 新增敏感字段加密服务（AES-256-GCM，FIELD_ENCRYPTION_KEY） - users 详情返回银行卡/身份证脱敏字段；新增 /users/:id/sensitive 特权明文接口并写审计 - 权限新增 system.users_sensitive（hr/admin） - 更新 env/README 与 v3 CSV 状态推进
61 行
2.0 KiB
Bash
61 行
2.0 KiB
Bash
DATABASE_URL="postgresql://hyboa_user:hyboa_password@localhost:5432/hyb_oa?schema=public"
|
||
JWT_SECRET="change_me"
|
||
# ===== 敏感字段加密（F25）=====
|
||
# 用于员工银行卡/身份证等字段的可逆加密（AES-256-GCM）。
|
||
# 生成方式示例：openssl rand -base64 32
|
||
# FIELD_ENCRYPTION_KEY=""
|
||
# APP_ORIGIN="https://oa.hyinda.com"
|
||
# COOKIE_SECURE="true"
|
||
# DEV_SHOW_PASSWORD_RESET_CODE="true"
|
||
APP_TIMEZONE="Asia/Shanghai"
|
||
STORAGE_DIR="generated/storage"
|
||
# STORAGE_DRIVER="local" # local|s3（MinIO/S3 兼容）
|
||
# S3_ENDPOINT="" # 例如：http://127.0.0.1:9000（MinIO）
|
||
# S3_REGION="us-east-1"
|
||
# S3_BUCKET="hyb-oa"
|
||
# S3_ACCESS_KEY_ID=""
|
||
# S3_SECRET_ACCESS_KEY=""
|
||
# S3_FORCE_PATH_STYLE="true" # MinIO 建议 true
|
||
SIGNED_URL_TTL_SECONDS="600"
|
||
MAX_UPLOAD_SIZE_BYTES="10485760"
|
||
|
||
# ===== Metrics（Prometheus）=====
|
||
# METRICS_ENABLED="true"
|
||
|
||
# ===== 单域托管 client/dist（试运行/生产建议）=====
|
||
# SERVE_CLIENT_DIST="true"
|
||
# CLIENT_DIST_DIR="../client/dist"
|
||
|
||
# ===== 安全基线（默认：production=true，其它环境=false，可显式覆盖）=====
|
||
# RATE_LIMIT_ENABLED="true"
|
||
# RATE_LIMIT_LOGIN_MAX="10"
|
||
# RATE_LIMIT_LOGIN_WINDOW="1 minute"
|
||
|
||
# ===== 登录安全（失败锁定/弱密码拦截）=====
|
||
# AUTH_LOGIN_FAIL_WINDOW_SECONDS="900" # 15min
|
||
# AUTH_LOGIN_FAIL_MAX_ATTEMPTS="5"
|
||
# AUTH_LOGIN_LOCK_SECONDS="1800" # 30min
|
||
# WEAK_PASSWORD_CHECK_ENABLED="true"
|
||
# WEAK_PASSWORD_MIN_SCORE="2" # zxcvbn score < 2 -> reject
|
||
|
||
DELEGATION_REVOKE_CRON="0 * * * *"
|
||
|
||
OCR_PROVIDER="off"
|
||
OCR_BATCH_SIZE="10"
|
||
OCR_LOCK_TTL_SECONDS="300"
|
||
OCR_POLL_CRON="* * * * *"
|
||
OCR_MAX_ATTEMPTS="3"
|
||
OCR_TIMEOUT_MS="5000"
|
||
|
||
INVOICE_ARCHIVE_CRON="30 2 * * *"
|
||
INVOICE_ARCHIVE_UNUSED_DAYS="90"
|
||
INVOICE_ARCHIVE_BATCH_SIZE="200"
|
||
TENCENT_SECRET_ID=""
|
||
TENCENT_SECRET_KEY=""
|
||
TENCENT_OCR_REGION="ap-beijing"
|
||
|
||
# ===== 试运行引导管理员（E20，可选）=====
|
||
# TRIALRUN_ADMIN_EMAIL="[email protected]"
|
||
# TRIALRUN_ADMIN_PHONE="13800000000"
|
||
# TRIALRUN_ADMIN_PASSWORD=""
|