514e26ebb4
M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel). - Apollo Client -> apollo-router (port 4010, RSC prefetch) - 5 layouts: classic/focus/split/triple/canvas - Registry + PluginLoader (dynamic import ssr:false) - 3-layer props merge, Zustand PluginStore - 4 widgets: grades/notification-bell/user-menu/class-selector - config-service: new pluginConfig GraphQL resolver - apollo-router: CORS + header propagation for portal-shell - docker-compose.yml: portal-shell service block
90 lines
2.0 KiB
YAML
90 lines
2.0 KiB
YAML
# Apollo Router 配置（v2.1 M2）
|
||
#
|
||
# Router 作为唯一的外部 GraphQL 入口，替代 3 个 BFF 的手动聚合。
|
||
# 前端 → Router（GraphQL）→ 各子图（/graphql）
|
||
# 内部调用（后端 → 后端）仍走 gRPC（ADR-037）。
|
||
#
|
||
# 端口：3000（NestJS BFF 段空闲端口）
|
||
# 镜像：ghcr.io/apollographql/router
|
||
|
||
supergraph:
|
||
listen: 0.0.0.0:3000
|
||
path: /graphql
|
||
introspection: true
|
||
|
||
# Sandbox 模式：支持开发和调试
|
||
homepage:
|
||
enabled: true
|
||
path: /
|
||
|
||
# CORS：允许前端 portal 访问
|
||
sandbox:
|
||
enabled: true
|
||
|
||
cors:
|
||
origins:
|
||
- "http://localhost:4000"
|
||
- "http://localhost:4001"
|
||
- "http://localhost:4002"
|
||
- "http://localhost:4003"
|
||
- "http://localhost:4010"
|
||
- "http://teacher-portal:4000"
|
||
- "http://student-portal:4001"
|
||
- "http://parent-portal:4002"
|
||
- "http://admin-portal:4003"
|
||
- "http://portal-shell:4010"
|
||
methods:
|
||
- GET
|
||
- POST
|
||
- OPTIONS
|
||
headers:
|
||
- Authorization
|
||
- Content-Type
|
||
- X-Request-Id
|
||
- X-Expected-Version
|
||
- If-Match
|
||
credentials: true
|
||
|
||
# 向所有子图注入 Router-Authorization Header（ADR-036）
|
||
# 子图的 RouterAuthGuard 校验此 Header，拒绝非 Router 的直接 GraphQL 请求
|
||
# 同时透传用户身份头（x-user-id / x-user-role）与 Authorization 到子图，
|
||
# 供 iam/core-edu/msg 等子图做用户级鉴权（M8：portal-shell 查询走 Router）
|
||
headers:
|
||
all:
|
||
request:
|
||
- add:
|
||
name: "router-authorization"
|
||
value: "${env.ROUTER_AUTH_SECRET}"
|
||
- propagate:
|
||
named: "Authorization"
|
||
- propagate:
|
||
named: "x-user-id"
|
||
- propagate:
|
||
named: "x-user-role"
|
||
- propagate:
|
||
named: "X-Request-Id"
|
||
|
||
# 流量控制
|
||
traffic_shaping:
|
||
all:
|
||
router:
|
||
timeout: 30s
|
||
subgraph:
|
||
timeout: 10s
|
||
global_rate_limit:
|
||
capacity: 1000
|
||
interval: 1s
|
||
|
||
# 健康检查
|
||
health_check:
|
||
listen: 0.0.0.0:8088
|
||
|
||
# 日志
|
||
telemetry:
|
||
instrumentation:
|
||
spans:
|
||
mode: spec_compliant
|
||
logging:
|
||
level: info
|
||
format: json
|