# Load through Nacos shared config or Spring additional-location. No usable keys are committed.
file-access:
  mode: observe
  block-browser-navigation: true
  ttl-seconds: 1800
  package-ttl-seconds: 86400
  future-skew-seconds: 300
  public-base-url: https://files.example.com/api
  allowed-origins:
    - https://legacy-files.example.com
  # Optional: old H5 needs no update; only GET/HEAD image reads bypass signatures.
  # Remove this list or set [] to keep all browser sources subject to signing.
  public-image-referer-prefixes:
    - https://www.pjzhhq.cn/mobile/
    # Root origin allows every page on this exact scheme/host/port (trailing slash optional).
    # Use only when cross-origin browser requests omit the Referer path; requires updated common-core/UPMS.
    # - https://yyfb.idw.jinhua.gov.cn:6443/
  legacy-dart:
    enabled: true
    extensions: [jpg, jpeg, png, gif, webp, bmp, svg, ico]
  upload:
    ttl-seconds: 300
    max-file-bytes: 209715200 # 200 MiB; gateway/servlet limits may be lower
    allowed-extensions: [jpg, jpeg, png, gif, webp, bmp, ico, svg, pdf, apk, doc, docx, xls, xlsx, ppt, pptx, txt, csv, zip, mp4, mov, webm, avi, mp3, wav, m4a, aac, ogg, amr, flac]
    internal-extensions: [log, gz] # service-signed inner-upload only
  clients:
    admin:
      active-kid: v1
      keys: {v1: '${FILE_ACCESS_ADMIN_V1:}'}
    h5:
      # Optional. Remove the whole h5 node if no H5 signing key is configured.
      active-kid: v1
      keys: {v1: '${FILE_ACCESS_H5_V1:}'}
    mini:
      active-kid: v1
      keys: {v1: '${FILE_ACCESS_MINI_V1:}'}
    flutter:
      active-kid: v1
      keys: {v1: '${FILE_ACCESS_FLUTTER_V1:}'}
    service:
      active-kid: v1
      keys: {v1: '${FILE_ACCESS_SERVICE_V1:}'}
    package:
      active-kid: v1
      keys: {v1: '${FILE_ACCESS_PACKAGE_V1:}'}