wangsli
f755ff0dda
- 组织/人员/委派对齐：费用类型、部门、员工别名、配置只读与回归脚本（F2/F3/F26/F27/F29/F31/F40） - 报销单 PATCH/DELETE 与 items CRUD（事务内重算 total_amount）（F4/F5） - 行政代提交/代上传后端校验与审计（F7/F8） - 认证安全基线：首次登录改密、失败锁定、弱密码拦截与回归脚本（F36/F37/F39/F41）
43 行
1.3 KiB
Bash
43 行
1.3 KiB
Bash
DATABASE_URL="postgresql://hyboa_user:hyboa_password@localhost:5432/hyb_oa?schema=public"
|
|
JWT_SECRET="change_me"
|
|
# APP_ORIGIN="https://oa.hyinda.com"
|
|
# COOKIE_SECURE="true"
|
|
# DEV_SHOW_PASSWORD_RESET_CODE="true"
|
|
APP_TIMEZONE="Asia/Shanghai"
|
|
STORAGE_DIR="generated/storage"
|
|
SIGNED_URL_TTL_SECONDS="600"
|
|
MAX_UPLOAD_SIZE_BYTES="10485760"
|
|
|
|
# ===== 单域托管 client/dist（试运行/生产建议）=====
|
|
# SERVE_CLIENT_DIST="true"
|
|
# CLIENT_DIST_DIR="../client/dist"
|
|
|
|
# ===== 安全基线（默认：production=true，其它环境=false，可显式覆盖）=====
|
|
# RATE_LIMIT_ENABLED="true"
|
|
# RATE_LIMIT_LOGIN_MAX="10"
|
|
# RATE_LIMIT_LOGIN_WINDOW="1 minute"
|
|
|
|
# ===== 登录安全（失败锁定/弱密码拦截）=====
|
|
# AUTH_LOGIN_FAIL_WINDOW_SECONDS="900" # 15min
|
|
# AUTH_LOGIN_FAIL_MAX_ATTEMPTS="5"
|
|
# AUTH_LOGIN_LOCK_SECONDS="1800" # 30min
|
|
# WEAK_PASSWORD_CHECK_ENABLED="true"
|
|
# WEAK_PASSWORD_MIN_SCORE="2" # zxcvbn score < 2 -> reject
|
|
|
|
DELEGATION_REVOKE_CRON="0 * * * *"
|
|
|
|
OCR_PROVIDER="off"
|
|
OCR_BATCH_SIZE="10"
|
|
OCR_LOCK_TTL_SECONDS="300"
|
|
OCR_POLL_CRON="* * * * *"
|
|
OCR_MAX_ATTEMPTS="3"
|
|
OCR_TIMEOUT_MS="5000"
|
|
TENCENT_SECRET_ID=""
|
|
TENCENT_SECRET_KEY=""
|
|
TENCENT_OCR_REGION="ap-beijing"
|
|
|
|
# ===== 试运行引导管理员（E20，可选）=====
|
|
# TRIALRUN_ADMIN_EMAIL="[email protected]"
|
|
# TRIALRUN_ADMIN_PHONE="13800000000"
|
|
# TRIALRUN_ADMIN_PASSWORD=""
|