# mjava 基座生产配置模板
# 使用方式：复制为 application-prod.yml 并填入真实值；真实文件已被 .gitignore 排除
# 敏感值统一走 ${ENV_VAR} 环境变量注入，不要硬编码

spring:
  datasource:
    hikari:
      connection-init-sql: SET NAMES utf8mb4 COLLATE utf8mb4_unicode_ci
    driver-class-name: com.mysql.cj.jdbc.Driver
    username: ${DB_USERNAME}
    password: ${DB_PASSWORD}
    url: ${DB_URL}
    # 主库
    primary:
      username: ${DB_PRIMARY_USERNAME}
      password: ${DB_PRIMARY_PASSWORD}
      jdbc-url: ${DB_PRIMARY_URL}
    # 从库
    slave:
      username: ${DB_SLAVE_USERNAME}
      password: ${DB_SLAVE_PASSWORD}
      jdbc-url: ${DB_SLAVE_URL}
  jpa:
    database: MYSQL
    database-platform: org.hibernate.dialect.MySQL57Dialect

# dingtalk
dingtalk:
  agentId: ${DINGTALK_AGENT_ID}
  appKey: ${DINGTALK_APP_KEY}
  appSecret: ${DINGTALK_APP_SECRET}
  corpId: ${DINGTALK_CORP_ID}
  aesKey: ${DINGTALK_AES_KEY}
  token: ${DINGTALK_TOKEN}

# teambition
teambition:
  AppID: ${TEAMBITION_APP_ID}
  AppSecret: ${TEAMBITION_APP_SECRET}
  TenantId: ${TEAMBITION_TENANT_ID}
  OperatorId: ${TEAMBITION_OPERATOR_ID}

# aliwork
aliwork:
  appType: ${ALIWORK_APP_TYPE}
  systemToken: ${ALIWORK_SYSTEM_TOKEN}

# integration（IAM 集成平台）
integration:
  baseUrl: ${INTP_BASE_URL}        # 不含 /iam 路径前缀
  clientId: ${INTP_CLIENT_ID}
  clientSecret: ${INTP_CLIENT_SECRET}

# h3yun
h3yun:
  engineCode: ${H3YUN_ENGINE_CODE}
  secret: ${H3YUN_SECRET}

# ekuaibao
ekuaibao:
  corpId: ${EKUAIBAO_CORP_ID}
  platformApi: https://app.ekuaibao.com

# fxiaoke
fxiaoke:
  appId: ${FXIAOKE_APP_ID}
  appSecret: ${FXIAOKE_APP_SECRET}
  permanentCode: ${FXIAOKE_PERMANENT_CODE}
  corpId: ${FXIAOKE_CORP_ID}

# diwork
diwork:
  appKey: ${DIWORK_APP_KEY}
  appSecret: ${DIWORK_APP_SECRET}

# u8open
u8open:
  appKey: ${U8OPEN_APP_KEY}
  appSecret: ${U8OPEN_APP_SECRET}
  toAccount: ${U8OPEN_TO_ACCOUNT}
  fromAccount: ${U8OPEN_FROM_ACCOUNT}

# feishu
feishu:
  appKey: ${FEISHU_APP_KEY}
  appSecret: ${FEISHU_APP_SECRET}
  encryptKey: ${FEISHU_ENCRYPT_KEY}
  verToken: ${FEISHU_VER_TOKEN}

# 企业配置
corp:
  engineers:
    - ${CORP_ENGINEER_1}
    - ${CORP_ENGINEER_2}

# 基座请求鉴权 + 防重放（默认关闭；按客户子模块按需开启）
# 启用条件：客户对外暴露 HTTP 接口且需 HMAC-SHA256 签名 + 时间窗 + Nonce 防重放
mjava:
  auth:
    enabled: false
    secret: ${AUTH_SECRET:}
    window: 300              # 时间窗（秒），超出窗口的请求拒绝
    nonce-cache-size: 10000  # 单实例 Nonce 缓存上限
