server:
  port: 8083
  cors:
    # Browser CORS allowlist. In production, replace this with the actual frontend or embedded-site domains, such as https://support.example.com.
    # Leave it empty to reject cross-origin browser requests. Same-origin and non-browser calls are still supported.
    allowedOrigins:
      - http://127.0.0.1:8083
      - http://localhost:8083

db:
  type: sqlite
  dsn: file:./data/app.db?_busy_timeout=5000
  maxIdleConns: 5
  maxOpenConns: 20
  connMaxIdleTimeSeconds: 300
  connMaxLifetimeSeconds: 1800

logger:
  level: info
  format: text
  addSource: false

auth:
  tokenTTLHours: 12
  maxFailedAttempts: 5
  credentialLockMinute: 15

customerSession:
  # Signing secret for customer service session tokens. Use a separate, high-entropy random string; do not reuse the channel userTokenSecret.
  secret: ""
  # Default lifetime for customer service session tokens, in minutes.
  ttlMinutes: 120
  # Automatically refresh the token when its remaining lifetime falls below this value, in minutes.
  refreshThresholdMinutes: 30

storage:
  # Default file storage provider used for uploads. Supported values: local, oss.
  # Empty value is treated as local by the backend.
  default: local
  # Maximum size of a single uploaded file, in MB. Values <= 0 fall back to the backend default.
  maxUploadSizeMB: 20
  local:
    # Files are written under this directory, relative to the process working directory unless an absolute path is used.
    root: data/storage
    # Public URL prefix used when returning local file URLs. The server must expose this path as static files.
    # Example: storage key "images/a.png" becomes "/storage/images/a.png".
    baseUrl: /storage
  oss:
    # Aliyun OSS endpoint. Both "oss-cn-hangzhou.aliyuncs.com" and "https://oss-cn-hangzhou.aliyuncs.com" are accepted.
    endpoint: ""
    # OSS bucket name.
    bucket: ""
    # OSS access credentials. Keep the secret out of committed environment-specific config.
    accessKeyId: ""
    accessKeySecret: ""
    # Optional public CDN/custom domain prefix for object URLs, for example https://files.example.com.
    # If empty, public buckets use the default bucket endpoint URL; private buckets use signed URLs.
    baseUrl: ""
    # Set to true for private buckets. Private buckets return temporary signed URLs for reads.
    private: false
    # Expiration for generated OSS signed GET URLs, in seconds. Values <= 0 fall back to 600.
    signedUrlExpireSeconds: 600

vectorDB:
  type: qdrant
  host: 127.0.0.1
  grpcPort: 6334
  apiKey: ""
  useTls: false

mcp:
  enabled: true
  servers:
    system:
      enabled: true
      endpoint: "http://127.0.0.1:8083/api/mcp"
      timeoutMs: 15000
      headers: {}

oidc:
  # Whether to enable OIDC login. This system acts as the OIDC client.
  enabled: false
  # OIDC provider issuer, for example https://idp.example.com/realms/demo.
  issuer: ""
  clientId: ""
  clientSecret: ""
  # Must exactly match the redirect_uri registered with the OIDC provider.
  redirectUrl: "http://127.0.0.1:8083/api/auth/oidc_callback"
  # Signing secret for the OIDC login state. If left empty, clientSecret is used as the fallback.
  stateSecret: ""
  scopes:
    - openid
    - profile
    - email

wxWork:
  # Whether to enable WeCom features.
  # When set to false, the WeCom SDK is not initialized, and login, customer service callbacks, and app notifications are unavailable.
  enabled: false
  # WeCom corporate ID.
  # Example: wwxxxxxxxxxxxxxxxx, from the WeCom admin console.
  corpId: 
  # WeCom app secret.
  # Used by the backend to obtain access tokens and user identities. Keep it confidential.
  corpSecret: ""
  # AgentID of the WeCom custom app.
  # Used for web authorization when scope=snsapi_privateinfo.
  agentId: 
  # WeCom web authorization callback URL.
  # Must be a full URL pointing to the backend endpoint:
  # Example: http://127.0.0.1:8083/api/auth/wxwork_callback
  # In production, use an official domain that WeCom can access, and make sure the domain is configured in the WeCom admin console.
  oauthRedirect: ""
  # Signing secret for the WeCom login state.
  # Used for tamper protection and replay protection. A separate random string is recommended.
  # If left empty, the code falls back to corpSecret, but this is not recommended.
  stateSecret: ""
  # Private key for decrypting WeCom callbacks.
  # Not used by the current login flow. Reserved for message callbacks and similar scenarios.
  rsaPrivateKey: ""
  # WeCom callback token.
  # Not used by the current login flow. Reserved for message callbacks and similar scenarios.
  token: ""
  # WeCom message encryption/decryption EncodingAESKey.
  # Not used by the current login flow. Reserved for message callbacks and similar scenarios.
  encodingAESKey: ""

  notify:
    # Whether to enable WeCom app message notifications.
    enabled: false
    # Default list of system user IDs to receive notifications. If the target business user has a bound WeCom identity, that user is preferred.
    # System user IDs are mapped to WeCom member IDs through identity bindings before messages are sent.
    toUsers: []
    # Whether to send confidential messages.
    safe: false
    # Whether to enable duplicate message checks.
    enableDuplicateCheck: true
    # Duplicate message check window, in seconds.
    duplicateCheckInterval: 1800