# 统一审批网关：同时负责钉钉 OA 与薪福通；终端用户不接触这些值
APP_MODE=gateway
DINGTALK_CREDENTIALS_FILE=/opt/dingMCP/.secrets/dingtalk.json
DINGTALK_CORP_ID=dingxxxxxxxx

# 固定公网 HTTPS 地址；反向代理转发到本机 3010 端口
MCP_PUBLIC_BASE_URL=https://approval.example.com
MCP_REMOTE_AUTH_ENABLED=true
MCP_BIND_HOST=127.0.0.1
PORT=3010
MCP_AUTH_DATABASE=/opt/dingMCP/.runtime/auth.sqlite
MCP_SESSION_SECRET_FILE=/opt/dingMCP/.secrets/oauth-session.key
MCP_APPROVAL_REF_SECRET_FILE=/opt/dingMCP/.secrets/approval-ref.key

# 薪福通正式 OpenAPI（网关必填；不支持 Cookie/Chromium 兼容模式）
XFT_OPEN_API_ENABLED=true
# XFT_OPEN_API_APP_ID=your-app-id
# XFT_OPEN_API_AUTHORITY_SECRET_FILE=/opt/dingMCP/.secrets/xft-open-api.secret
# XFT_OPEN_API_ENTERPRISE_ID=your-enterprise-id
# XFT_OPEN_API_BASE_URL=https://api.cmbchina.com
# XFT_OPEN_API_ENCRYPTED=true
# XFT_OPEN_API_DINGTALK_APP_CODE=DDingTalk

# 调优
# OFFICIAL_OA_LOOKBACK_DAYS=120
# 审批写入批量上限固定为 20，不提供环境变量覆盖。
# MCP_ACCESS_TOKEN_TTL_SECONDS=900
# MCP_REFRESH_TOKEN_TTL_SECONDS=2592000