returnfmt.Errorf("jwt.expire_hour must be <= 168 (7 days)")
}
ifc.JWT.ExpireHour>24{
log.Printf("Warning: jwt.expire_hour is %d hours (> 24). Consider shorter expiration for security.",c.JWT.ExpireHour)
slog.Warn("jwt.expire_hour is high; consider shorter expiration for security","expire_hour",c.JWT.ExpireHour)
}
// JWT Refresh Token配置验证
ifc.JWT.AccessTokenExpireMinutes<=0{
returnfmt.Errorf("jwt.access_token_expire_minutes must be positive")
}
ifc.JWT.AccessTokenExpireMinutes>720{
log.Printf("Warning: jwt.access_token_expire_minutes is %d (> 720). Consider shorter expiration for security.",c.JWT.AccessTokenExpireMinutes)
slog.Warn("jwt.access_token_expire_minutes is high; consider shorter expiration for security","access_token_expire_minutes",c.JWT.AccessTokenExpireMinutes)
}
ifc.JWT.RefreshTokenExpireDays<=0{
returnfmt.Errorf("jwt.refresh_token_expire_days must be positive")
}
ifc.JWT.RefreshTokenExpireDays>90{
log.Printf("Warning: jwt.refresh_token_expire_days is %d (> 90). Consider shorter expiration for security.",c.JWT.RefreshTokenExpireDays)
slog.Warn("jwt.refresh_token_expire_days is high; consider shorter expiration for security","refresh_token_expire_days",c.JWT.RefreshTokenExpireDays)
}
ifc.JWT.RefreshWindowMinutes<0{
returnfmt.Errorf("jwt.refresh_window_minutes must be non-negative")
returnfmt.Errorf("gateway.idle_conn_timeout_seconds must be positive")
}
ifc.Gateway.IdleConnTimeoutSeconds>180{
log.Printf("Warning: gateway.idle_conn_timeout_seconds is %d (> 180). Consider 60-120 seconds for better connection reuse.",c.Gateway.IdleConnTimeoutSeconds)
slog.Warn("gateway.idle_conn_timeout_seconds is high; consider 60-120 seconds for better connection reuse","idle_conn_timeout_seconds",c.Gateway.IdleConnTimeoutSeconds)
}
ifc.Gateway.MaxUpstreamClients<=0{
returnfmt.Errorf("gateway.max_upstream_clients must be positive")
...
...
@@ -1682,6 +1788,6 @@ func warnIfInsecureURL(field, raw string) {
return
}
ifstrings.EqualFold(u.Scheme,"http"){
log.Printf("Warning: %s uses http scheme; use https in production to avoid token leakage.",field)
slog.Warn("url uses http scheme; use https in production to avoid token leakage","field",field)
log.Printf("[OpsWS] invalid %s=%q (expected %q or %q); using default=%q",envOpsWSOriginPolicy,v,OriginPolicyStrict,OriginPolicyPermissive,cfg.OriginPolicy)
logger.LegacyPrintf("handler.admin.ops_ws","[OpsWS] invalid %s=%q (expected %q or %q); using default=%q",envOpsWSOriginPolicy,v,OriginPolicyStrict,OriginPolicyPermissive,cfg.OriginPolicy)
h.errorResponse(c,http.StatusBadRequest,"invalid_request_error","function_call_output requires call_id or previous_response_id; if relying on history, ensure store=true and reuse previous_response_id")
h.errorResponse(c,http.StatusBadRequest,"invalid_request_error","function_call_output requires item_reference ids matching each call_id, or previous_response_id/tool_call context; if relying on history, ensure store=true and reuse previous_response_id")
