WorkBuddy
d3735e3afa
后端： - V056 matchmaker_contact_authorizations 表：channel CHECK(phone/offline_meeting/full_contact)、六态状态机(pending_approval→pending_consent→active→expired/revoked, →rejected)、部分唯一索引 uq_mm_contact_auth_active 防同红娘-同用户-同渠道多 ACTIVE、双态惰性收敛(active 过期 + pending_consent 超同意窗口) - ContactAuthorizationConfig 五 canonical key(matchmaker.contact.*)：enabled 代码缺省 false fail-safe(yml 显式 true)/approver-authorities 双岗并列/consent-deadline-hours 72/default-validity-days 7/retention-days 365，全部 DEFAULT+CONFIG 待产品+法务终审 - ContactAuthorizationPolicy.assertContactAllowed(404 化 deny 先审计后 404) + canContact 徽标查询 - ContactAuthorizationService：request(须有效分配+purpose 必填)/approve(权限码动态判定∈配置+组长组织范围)/consent(用户本人,仅 pending_consent)/decline/revoke(reason 必填)/disclose(唯一披露出口：enabled fail-safe→assertActiveAssignment→assertContactAllowed→仅返回 phone/disclosedAt/authorizationId 三键，每次落 SensitiveAccessLog user_phone_disclosure，phone 不落应用日志) - 双控制器：运营端 /operator/matchmaker/contact-authorizations + C 端 /contact-authorizations(UserPrincipal 归属校验,独立端点无预同意参数)，不碰 SecurityConfig 守卫翻转（机械锁强制复审机制按设计生效）： - MatchmakerContactGuardTest 由「锁不存在」翻转为「锁新契约」五条：回显白名单类收敛/端点前缀收敛(受治理三包)/到期语义/consent 独立性三端扫描(后端+miniapp+admin-web,修复原只扫后端的预同意参数逃逸缺口)/ReferralService 白名单与无 @Scheduled 保留 - run-backend-contracts CURATED 18→20 前端： - miniapp 新页 pages/contact-consent(目的/渠道/窗口明示+独立同意拒绝按钮无预勾选,app.json 第 64 页) + 红娘工作台申请/列表/撤销 - admin-web「联系授权审批」tab(审批岗队列+本人授权撤销,枚举码中文映射) 验证：mvn verify 895/895(3 skip)、UI 契约 24/24(64 页)、后端契约门禁 228/CURATED 20、小程序真编译 87 WXML 0 失败；负向注入 5(工程师)+2(QA 不同落点)判红→还原复绿；QA 抓 disclose 键数收敛断言缺口已补并回归；QA fresh eyes PASS 0 P0/P1
105 lines
2.4 KiB
YAML
105 lines
2.4 KiB
YAML
server:
|
||
port: 8080
|
||
servlet:
|
||
context-path: /api/v1
|
||
|
||
spring:
|
||
application:
|
||
name: danyang-match-platform
|
||
|
||
profiles:
|
||
active: dev
|
||
|
||
datasource:
|
||
url: jdbc:postgresql://${DB_HOST:localhost}:${DB_PORT:5432}/${DB_NAME:danyang_match}
|
||
username: ${DB_USER:postgres}
|
||
password: ${DB_PASSWORD:postgres}
|
||
driver-class-name: org.postgresql.Driver
|
||
hikari:
|
||
maximum-pool-size: 20
|
||
minimum-idle: 5
|
||
idle-timeout: 30000
|
||
max-lifetime: 1800000
|
||
connection-timeout: 30000
|
||
|
||
jackson:
|
||
default-property-inclusion: non_null
|
||
serialization:
|
||
write-dates-as-timestamps: false
|
||
deserialization:
|
||
fail-on-unknown-properties: false
|
||
|
||
flyway:
|
||
enabled: true
|
||
locations: classpath:db/migration
|
||
baseline-on-migrate: true
|
||
baseline-version: 0
|
||
out-of-order: false
|
||
|
||
data:
|
||
redis:
|
||
host: ${REDIS_HOST:localhost}
|
||
port: ${REDIS_PORT:6379}
|
||
password: ${REDIS_PASSWORD:}
|
||
timeout: 5000ms
|
||
|
||
main:
|
||
allow-bean-definition-overriding: false
|
||
|
||
# MyBatis-Plus
|
||
mybatis-plus:
|
||
configuration:
|
||
map-underscore-to-camel-case: true
|
||
log-impl: org.apache.ibatis.logging.slf4j.Slf4jImpl
|
||
type-handlers-package: com.danyang.match.platform.shared.typehandler
|
||
global-config:
|
||
db-config:
|
||
id-type: assign_uuid
|
||
|
||
# Logging
|
||
logging:
|
||
level:
|
||
root: INFO
|
||
com.danyang.match.platform: DEBUG
|
||
org.springframework.security: INFO
|
||
org.mybatis: DEBUG
|
||
pattern:
|
||
console: '%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] [%X{requestId}] %-5level %logger{36} - %msg%n'
|
||
|
||
# Actuator
|
||
management:
|
||
endpoints:
|
||
web:
|
||
exposure:
|
||
include: health,info,metrics,prometheus
|
||
endpoint:
|
||
health:
|
||
show-details: when_authorized
|
||
show-components: always
|
||
health:
|
||
db:
|
||
enabled: true
|
||
redis:
|
||
enabled: true
|
||
|
||
# Spring Security (default disable for dev, will be configured in security module)
|
||
spring.security:
|
||
user:
|
||
name: admin
|
||
password: admin
|
||
|
||
# Rate limiting
|
||
rate-limit:
|
||
max-requests-per-window: 20
|
||
window-seconds: 60
|
||
|
||
# 受控联系授权（ZC-MM-003 / B1 立项，canonical key 见 ContactAuthorizationConfig；治理登记 T06 config-register）
|
||
# 注意：代码缺省 enabled=false（fail-safe），生产显式开启；新环境漏配时机制整体关闭而非意外开放。
|
||
matchmaker:
|
||
contact:
|
||
enabled: true
|
||
approver-authorities: matchmaker.team.assign,matchmaker.assign
|
||
consent-deadline-hours: 72
|
||
default-validity-days: 7
|
||
retention-days: 365
|