feat(api): 开发平台、门店相关代码

apps/api/src/config/app-config.module.ts

@@ -19,8 +19,7 @@ function findEnvironmentFile(): string {
     return environmentFile ?? resolve(process.cwd(), '.env');
 }
 
-// This schema is the only supported source for API runtime settings. Defaults are
-// intentionally limited to non-secret local-development values.
+// 此 schema 是 API 运行配置的唯一来源；默认值只允许用于不含秘密的本地开发场景。
 const environmentSchema = z.object({
     NODE_ENV: z
         .enum(['development', 'test', 'production'])
@@ -31,6 +30,13 @@ const environmentSchema = z.object({
     REDIS_URL: z.url(),
     AUTH_JWT_SECRET: z.string().min(32),
     AUTH_RATE_LIMIT_KEY_SECRET: z.string().min(32),
+    STORE_SECRET_ENCRYPTION_KEY: z.string().min(32),
+    STORE_SECRET_ENCRYPTION_KEY_VERSION: z
+        .string()
+        .min(1)
+        .max(64)
+        .default('v1'),
+    IDEMPOTENCY_KEY_SECRET: z.string().min(32),
     AUTH_PASSWORD_MIN_LENGTH: z.coerce
         .number()
         .int()
@@ -83,7 +89,7 @@ function validateEnvironment(
 ): Environment {
     const result = environmentSchema.safeParse(environment);
     if (result.success) return result.data;
-    // Fail before Nest opens a listener; a half-configured API is unsafe to run.
+    // 在 Nest 开始监听前失败，避免半配置 API 对外提供不安全服务。
     throw new Error(
         `Invalid environment configuration: ${result.error.issues.map((issue) => issue.path.join('.')).join(', ')}`,
     );
@@ -92,7 +98,7 @@ function validateEnvironment(
 function createAppConfig(environment: Environment): AppConfig {
     return {
         ...environment,
-        // Express only trusts forwarding headers when this explicit allowlist is non-empty.
+        // 只有显式给出代理网段时才信任转发头，避免客户端伪造来源 IP。
         trustedProxyCidrs: environment.TRUSTED_PROXY_CIDRS.split(',')
             .map((value) => value.trim())
             .filter(Boolean),
@@ -106,15 +112,14 @@ function createAppConfig(environment: Environment): AppConfig {
         ConfigModule.forRoot({
             isGlobal: true,
             cache: true,
-            // Turbo runs this workspace's scripts from apps/api, while the
-            // shared development environment lives at the repository root.
+            // Turbo 从 apps/api 运行脚本，但共享开发环境文件位于仓库根目录。
             envFilePath: findEnvironmentFile(),
         }),
     ],
     providers: [
         {
             provide: APP_CONFIG,
-            // Export a normalized immutable config object so services never read process.env directly.
+            // 导出规范化配置，业务服务不得散落读取 process.env。
             useFactory: (): AppConfig =>
                 createAppConfig(validateEnvironment(process.env)),
         },