fix version 1

pkgs/ecmall/etc/default_dev.yaml

@@ -14,12 +14,15 @@ Databases:
     - host=127.0.0.1 user=postgres password=Weidong1214 dbname=bsm_dev port=5432 sslmode=disable TimeZone=Asia/Shanghai
 
 Cache: redis://null:Weidong1214@127.0.0.1:6379/1
-SecretKey: CHANGE_ME
+
+# session cookie 的 HMAC 密钥，必须由部署通过环境变量提供，不得留空或使用公开占位值。
+SecretKey: ${BSM_SECRET_KEY}
 
 # Authorization contains the HS256 signing key and maximum token lifetime in
 # seconds. Clients send the raw JWT in the Authorization header (no Bearer).
+# 签名密钥必须由 BSM_JwtSecretKey 环境变量提供；公开样例值会被入口拒绝。
 Authorization:
-  Key: CHANGE_ME_32_BYTE_JWT_SECRET_KEY
+  Key: ${BSM_JwtSecretKey}
   Expire: 86400
   Anonymous:
     - /passport.Login/Pwd
@@ -65,9 +68,9 @@ Services:
 
 # Service-specific configuration is flat at the document root. Shared
 # database, Redis, RPC, APM and Etcd settings above are assigned automatically.
-# Fts / Mgt are passed to their modules through ExposeOptions.Config. Note that
-# the aggregate never runs a module's model migration or seeding, so
-# Mgt.InitRootUser does not create the root administrator here (see AGENT.md §3.5).
+# Fts / Mgt are passed to their modules through ExposeOptions.Config.
+# 聚合启动时会执行各模块经 database.AppendMigrate 注册的表迁移，但不会执行各模块的
+# InitData 播种，因此 Mgt.InitRootUser 在聚合下仍不会创建 root 管理员（见 AGENT.md §3.5）。
 Fts:
   MinioOss:
     Site: http://127.0.0.1:9000