b30d43f983
Task 12-13 of portal-shell data abstraction plan (M3 security). APQ (Automatic Persisted Queries): - Add createPersistedQueryLink with sha256 to apollo-client.ts - Production: client sends only query hash, not plaintext query - Dev: NEXT_PUBLIC_APOLLO_APQ=false to disable for debugging - Prevents attackers from crafting arbitrary queries via DevTools PQ Manifest generator: - New scripts/generate-pq-manifest.ts iterates operations barrel - Outputs public/pq-manifest.json (sha256 -> query text whitelist) - prebuild hook: codegen + generate-pq-manifest before next build - 51 queries currently registered - crypto-hash dependency added - typecheck + lint (0 errors) + test (85/85) verified
30 lines
1.2 KiB
Plaintext
30 lines
1.2 KiB
Plaintext
# portal-shell 环境变量模板（v2.1 M8）
|
||
#
|
||
# 复制为 .env.local 后按实际环境填写。
|
||
# 服务端变量不加 NEXT_PUBLIC_ 前缀；前端变量必须加。
|
||
|
||
# Apollo Router（GraphQL 联邦入口，M8 验收点）
|
||
# 前端 Apollo Client 直连此地址
|
||
NEXT_PUBLIC_APOLLO_ROUTER_URL=http://localhost:3000/graphql
|
||
# 服务端 RSC 预取用（容器内走内部网络）
|
||
APOLLO_ROUTER_URL=http://localhost:3000/graphql
|
||
|
||
# Apollo Client APQ 开关（v2.1 M3 安全加固）
|
||
# 生产环境必须为 true（前端只发 query hash，不发明文 query）
|
||
# 开发环境可设为 false 便于 DevTools 调试
|
||
NEXT_PUBLIC_APOLLO_APQ=true
|
||
|
||
# config-service 直连地址（开发态降级用）
|
||
# 当 apollo-router 不可用时，fetchPluginConfig 会降级直连此地址的 /graphql 端点
|
||
# 生产环境不需要配置（apollo-router 必须可用）
|
||
CONFIG_SERVICE_URL=http://localhost:3011
|
||
|
||
# API Gateway（JWT 校验 + 注入 x-user-id / x-user-role）
|
||
NEXT_PUBLIC_API_GATEWAY_URL=http://localhost:8080
|
||
|
||
# Realtime Gateway（SSE 推送）
|
||
NEXT_PUBLIC_REALTIME_GATEWAY_URL=http://localhost:8081
|
||
|
||
# 开发模式（未登录时使用 dev-user / teacher 兜底）
|
||
NEXT_PUBLIC_DEV_MODE=true
|