water/server/config/mini_api.php

<?php

return [
    // Independent opaque sessions; local test identities are isolated from WeChat.
    // This API never uses the admin JWT verifier or trusts user IDs sent by the client.
    'token_verifier' => \app\miniapi\auth\SessionVerifier::class,
    'wechat_appid' => env('MINI_WECHAT_APPID', ''),
    'wechat_secret' => env('MINI_WECHAT_SECRET', ''),
    'environment' => env('APP_ENV', 'production'),
    'test_phone_login' => filter_var(env('MINI_TEST_PHONE_LOGIN', false), FILTER_VALIDATE_BOOLEAN),
    'test_phone_allowed_ips' => array_values(array_filter(array_map('trim', explode(',', (string) env(
        'MINI_TEST_PHONE_ALLOWED_IPS',
        '127.0.0.1,::1'
    ))))),
    // Only these peers may set X-Forwarded-For. Behind a reverse proxy every caller otherwise
    // shares one address, which merges login throttling and the test phone allowlist.
    // Loopback is trusted by default because it is unreachable from the network; list every
    // proxy hop explicitly when deploying behind Nginx or a load balancer.
    'trusted_proxies' => array_values(array_filter(array_map('trim', explode(',', (string) env(
        'MINI_TRUSTED_PROXIES',
        '127.0.0.1,::1'
    ))))),
    // SMS login is a second credential for an account that already exists: the phone must be
    // bound by an administrator first. Codes are stored only as hashes and are single use.
    'sms_login' => filter_var(env('MINI_SMS_LOGIN', false), FILTER_VALIDATE_BOOLEAN),
    'sms_user' => (string) env('MINI_SMS_USER', ''),
    'sms_password' => (string) env('MINI_SMS_PASSWORD', ''),
    'sms_endpoint' => (string) env('MINI_SMS_ENDPOINT', 'https://api.smsbao.com/sms'),
    // Optional extra HMAC key for code hashing; falls back to the SMS password, which is already secret.
    'sms_code_pepper' => (string) env('MINI_SMS_CODE_PEPPER', ''),
    'sms_code_ttl' => 300,
    'sms_resend_interval' => 60,
    'sms_max_attempts' => 5,
    'sms_daily_per_phone' => 10,
    'sms_per_ip_per_hour' => 30,
    'session_ttl' => 604800,
    'login_ip_per_minute' => 60,
    'login_global_per_minute' => 600,
    'max_photo_body_bytes' => 3000000,
    'support_phone' => env('MINI_SUPPORT_PHONE', ''),
    'purchase_agreement_url' => env('MINI_PURCHASE_AGREEMENT_URL', ''),
    'privacy_url' => env('MINI_PRIVACY_URL', ''),
    'max_body_bytes' => 65536,
    'max_page_size' => 100,
    // Exact browser origins only. Local Swagger UI is served by the API on port 8787.
    // Override with a comma-separated list for HTTPS deployments; an empty value disables browser origins.
    'allowed_origins' => array_values(array_filter(array_map('trim', explode(',', (string) env(
        'MINI_ALLOWED_ORIGINS',
        'http://127.0.0.1:8787,http://localhost:8787'
    ))))),
];