server:
  port: ${SERVER_PORT:8080}

spring:
  application:
    name: talent-card-server
  servlet:
    multipart:
      max-file-size: 10MB
      max-request-size: 10MB
  datasource:
    ## url: ${MYSQL_URL:jdbc:mysql://192.168.110.13:3306/talent_card?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true&useSSL=false}
    url: ${MYSQL_URL:jdbc:mysql://127.0.0.1:8134/talent_card?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&allowPublicKeyRetrieval=true&useSSL=false}
    username: ${MYSQL_USERNAME:root}
    password: ${MYSQL_PASSWORD:123456}
    driver-class-name: com.mysql.cj.jdbc.Driver
    hikari:
      # 池只有 10 条连接，任何一条被长期占用都足以让整个后台排队到超时
      # （2026-09-15 的事故：一个空闲未提交事务持着元数据锁，ALTER 无限等锁，
      # 该表所有查询跟着排队，10 条连接很快被借光，健康检查都超时）。
      # 超过这个时间还没归还的连接，Hikari 会连调用栈一起打进日志——
      # 这是定位「谁在长事务里等外部 HTTP」最直接的手段。
      leak-detection-threshold: 10000
  data:
    redis:
      host: ${REDIS_HOST:localhost}
      port: ${REDIS_PORT:6368}
      password: ${REDIS_PASSWORD:123456}
      database: ${REDIS_DATABASE:0}
      timeout: 3s
      repositories:
        enabled: false
  flyway:
    enabled: false
    locations: classpath:db/migration
    baseline-on-migrate: true
  jpa:
    hibernate:
      ddl-auto: validate
    open-in-view: false
    properties:
      hibernate:
        format_sql: true
        jdbc:
          time_zone: Asia/Shanghai

app:
  cors:
    # 后台管理端（vite dev，默认 5273）与 HBuilderX Web 调试来源；部署时用 CORS_ALLOWED_ORIGINS 覆盖为真实域名。
    # localhost 与局域网地址都要列：换网段后局域网 IP 会变，localhost 是最稳的调试入口。
    allowed-origins: ${CORS_ALLOWED_ORIGINS:http://localhost:5273,http://127.0.0.1:5273,http://localhost:7893,http://localhost:7894,http://127.0.0.1:7893,http://127.0.0.1:7894,http://192.168.110.26:5273,http://192.168.110.26:,http://192.168.110.15:5273,http://192.168.110.15:5173}
    # 本机调试来源的端口是随机的：微信开发者工具每次启动都换一个端口（见过 42665），
    # HBuilderX 内置浏览器同理。写死端口必然漏，所以按 origin 通配匹配任意端口。
    # 只放行 localhost / 127.0.0.1，不对公网来源开口子；真实域名请加进上面的精确白名单。
    allowed-origin-patterns: ${CORS_ALLOWED_ORIGIN_PATTERNS:http://localhost:[*],http://127.0.0.1:[*]}
  # 核销后把延迟入账的钱确认给商户；确认失败或超时时由这个补偿任务重试，避免钱永远冻在延迟户。
  privacy:
    # Production must provide APP_PRIVACY_ENCRYPTION_KEY through the deployment secret store.
    encryption-key: ${APP_PRIVACY_ENCRYPTION_KEY:talent-card-local-development-key}
  upload:
    directory: ${UPLOAD_DIR:uploads}
  external-web:
    # Only URLs on these operator-approved HTTPS hosts can be returned to the mini-program.
    allowed-hosts: ${EXTERNAL_WEB_ALLOWED_HOSTS:${CAR_WASH_ALLOWED_WEB_HOSTS:}}
  development-session:
    # Local payment debugging only. Set false before any shared or production deployment.
    enabled: false
    talent-id: 2
  payment:
    # 核销后把延迟入账的钱确认给商户；确认失败或超时时由补偿任务重试，避免钱永远冻在延迟户。
    fund-confirmation-retry:
      fixed-delay-ms: ${FUND_CONFIRMATION_RETRY_FIXED_DELAY_MS:300000}
    huifu:
      # Keep disabled until the Huifu test/production product, merchant and keys are provisioned.
      enabled: true
      environment: prod
      system-id: 6666000226048687
      product-id: KAZX
      merchant-id: 6666000226048687
      mini-program-app-id: wxcfee477acb54d179
      private-key: MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCzPfipd3gxqHSr/ZiZG4hGXXulhXY9PCdf644SiE8IpH2Gf8pmvfTgs77FoyWVAPmYyF3JrQGQTlKjtHzkUGW20FETwopDwh7KP9zUvrHRHsAhCEi+kkD+4OO4BgP6I4sxJRANcVQM/G0woScxdHJB74gxVVnlxr3RpiR2aKyaEX6jCIsYiCXcuNJ7tpjX5H6pnFEldjWQpJgd1QnLrybgf66mEzQ/ym7SvaQ8oNWiILcpmUsAOUMwMgEr4J9MWTW/XH78++GtvrjEH311lmOk7+cM9qhGzvguXUFQkLnckseYnYAoEUaXmioBXu5qrqifMGZYCThLX9pzbJsFgswxAgMBAAECggEAbVdxmJert8dGnSDPdR8Ji7s9UWTQE1zdvDLq8T070U7e0CymoPRiLK0ZxGDY7UOx/1TDeeLTIF/XI8xXn8O3uMTtoLs9M0Z5F/HLWfCWcrZqh/wQvEhl49X2tGzfAjmqkKlGWJz4pA9c4Jx+Vzns9XIUx9uEQppxczIB7kW+fSEHGGIrilMbFPDWlqkjMuMBN7pDNUCMh9zEYCweLAzB1ZM0W3DVrRntCHJj1nLEFmBAsVDDy5J/m1Ew1SQ0252Ky8arYF6FjeOpnzw8WbCAXk6Cb3hjz83KWyoLXMzrHvkzEaR8eSaB5rmDP2Ukz5FIclqK91aMFVL8OQzq7Vh2fQKBgQDkWQIFK8s+YasyqcM+goXeYh+89anwbSbFB3yWrkIJrfh2aCjV0i/71tqh3aGKIZXokjoBR6ASWlHHtYJtAoms5wdvp6W/8phWlpM4clEsb8BHlQhWy+XCvH+KVVZAQrNMsAZPtUp/FhURnXJm7c7A9z3a0O10pSRu0ZuDcWc9OwKBgQDI8qS85p5Z5uy9WWcU676wS7dXyXK6Ev6Z3gMQpj2sGwCDOj0eZr3QZnLkFzLqV87pp5hsqX2xjphOrlVFKQDyWES5VF0hkX6jRMyodRw72FNEBAtEHXTaLY8QuBS6Sdxktywa50KZzbyJJ3RZgdFCpMwLxMakRG090nzhsu/1gwKBgQDA6pHSXJVxNoK0YsgY35zJrIyzz7iq7wx6GUEg7EfOdbQcFROq0dDIK1S6u8vmL0m/Gwr2WdTarIO6/ZYbErHN6cFWi4R1Dje1r7DhV3NM33zK/RX2fny2cRovfLlJwRBKEczDOp6dj8JtB1/HpdGvJTKU0z5J9ds55MxF2GEoUQKBgQCFp44W7rVISqYP0xUS/zIYBGRwCVc7mEKriNU1D71ZaaRPpD7ep6t8n4evWhbNc5X2JzjknV8y6As52g5xL7KnfjpHomtHVoSKh8owCaS70UigpqfvqD/+lergTe/LcDEc9BBr3IGZ1xOdjhZ/Ki9LSl1FPp54x+J5CjVx0Rh1jQKBgGfyr/mG9BMoXu6tHUoxxY5xw0Q8IA2N0kcSoilp233QQRBnxnO4zm7FITpnovaGvTj9LT6K+kDWxDTGG/Da+qzxtAMquJ5ZRpWv3fGEu6jzsJWcxTLMTiNroezq8oynNQbVqLlst1hl0LP6hX60b4jjEKHcQQKCerGav19Ay2Hj
      platform-public-key: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhRV2nN2xnEGw4giX8O/K3j3UdD80QKeigZqkPaVPULBc8D/Ov9bzioz/eMsprbI1grU8M6LCcGC0eFgBpA5YHxKzL4bjiAxzYbbzK/l+LaqD1Xzg4/k5qYiPe7I8BUU5FcpR37sRgO+14dwUYtFyjuIDENcsiUcadEpt45xxfFDKm+xaKtEBGDYS4fRQoVd/QvXTf6dZwWyK15uB84gqyjQFwJF+r4FtmSwe11bLf83D9M5nHpfZ8xiRNPGUXWaoeX6TT/QMY94Ep5hdkqGiNYJsk8Fdvdqkpelqqk4EGeGNBoHcvEZ6pIorFNUTZ0L99BI8poOGia+71W82xd20vwIDAQAB
      notify-url: ${HUIFU_NOTIFY_URL:http://221.182.45.100:11451/api/payments/huifu/notify}
      merchant-onboarding-notify-url: ${HUIFU_MERCHANT_ONBOARDING_NOTIFY_URL:http://221.182.45.100:11451/api/payments/huifu/merchant-onboarding-notify}
      merchant-wechat-config-notify-url: ${HUIFU_MERCHANT_WECHAT_CONFIG_NOTIFY_URL:http://221.182.45.100:11451/api/payments/huifu/merchant-wechat-config-notify}
      merchant-business-open-notify-url: ${HUIFU_MERCHANT_BUSINESS_OPEN_NOTIFY_URL:http://221.182.45.100:11451/api/payments/huifu/merchant-business-open-notify}
      onboarding-upper-huifu-id: ${HUIFU_ONBOARDING_UPPER_HUIFU_ID:6666000220591054}
      # 把新商户建成平台自己的下级商户（head_office_flag=0 + head_huifu_id）。
      # 不建在自己名下的话，平台无权操作该商户，进件后的「微信支付配置 + 业务开通」全部
      # 会返回 20002 数据权限认证失败，商户就得自己去汇付控台配置 —— 那正是要避免的。
      # 置空则退回普通进件（归属由 upper-huifu-id 决定），仅用于排查。
      onboarding-parent-huifu-id: ${HUIFU_ONBOARDING_PARENT_HUIFU_ID:6666000226048687}
      merchant-wechat-fee-rate: ${HUIFU_MERCHANT_WECHAT_FEE_RATE:0.60}
      merchant-online-business-type: ${HUIFU_MERCHANT_ONLINE_BUSINESS_TYPE:H5311L}
      merchant-online-media-name: ${HUIFU_MERCHANT_ONLINE_MEDIA_NAME:东区人才卡}
      merchant-agreement-url: ${HUIFU_MERCHANT_AGREEMENT_URL:https://cloudpnrcdn.oss-cn-shanghai.aliyuncs.com/opps/api/prod/download_file/PaymentServiceAgreement.htm}
      # 收款能力只要求「斗拱子商户正常 + 取现可用」：未核销的钱由延迟户兜住，
      # 自动结算开着不再影响收款。设 false 仅用于刻意跳过通道能力确认的部署。
      merchant-capability-required: ${HUIFU_MERCHANT_CAPABILITY_REQUIRED:true}
      capability-refresh:
        enabled: ${HUIFU_CAPABILITY_REFRESH_ENABLED:true}
        stale-hours: ${HUIFU_CAPABILITY_STALE_HOURS:6}
        fixed-delay-ms: ${HUIFU_CAPABILITY_REFRESH_FIXED_DELAY_MS:1800000}
  wechat:
    mini-program:
      # The app id must be the same mini-program that invokes uni.login and uni.requestPayment.
      app-id: ${WECHAT_MINI_PROGRAM_APP_ID:wxcfee477acb54d179}
      # Keep this only in the deployment environment. It is required to exchange a wx.login code for an OpenID.
      app-secret: ${WECHAT_MINI_PROGRAM_APP_SECRET:716aae42f04d3c5f17904e894f1c1ee9}

management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics
  endpoint:
    health:
      probes:
        enabled: true

logging:
  level:
    com.talentcard.server: debug