@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/core/config/config_test.go

@@ -0,0 +1,1122 @@
+package config
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"{{module}}/internal/common/serviceidentity"
+)
+
+const testIdentityPhoneHashKey = "0123456789abcdef0123456789abcdef"
+const testIdentityOAuthStateSigningSecret = "oauth-state-signing-secret-32-bytes-minimum"
+const testBootstrapCredentialRef = "vault://kv/onex/prod/iam/platform-api-bootstrap-credential"
+const testServiceTokenPrivateKeyPath = "/run/secrets/iam-service-token-private.pem"
+const testServiceTokenPublicKeyDirectory = "/run/secrets/iam-service-token-public"
+
+func TestValidateFeatureFlagConfig(t *testing.T) {
+	valid := FeatureFlagConfig{
+		FreshnessTTL:    30 * time.Second,
+		MaximumStaleAge: 15 * time.Minute,
+		CacheTTL:        30 * time.Minute,
+	}
+	require.NoError(t, validateFeatureFlagConfig(valid))
+
+	invalid := []FeatureFlagConfig{
+		{FreshnessTTL: 0, MaximumStaleAge: time.Minute, CacheTTL: time.Minute},
+		{FreshnessTTL: time.Minute, MaximumStaleAge: 30 * time.Second, CacheTTL: time.Minute},
+		{FreshnessTTL: time.Second, MaximumStaleAge: time.Minute, CacheTTL: 30 * time.Second},
+	}
+	for _, candidate := range invalid {
+		require.Error(t, validateFeatureFlagConfig(candidate))
+	}
+}
+
+// TestConfigIsDevelopment 验证 IsDevelopment() 对各环境值的行为
+func TestConfigIsDevelopment(t *testing.T) {
+	t.Run("returns true for development", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "development"}}
+		assert.True(t, cfg.IsDevelopment())
+	})
+
+	t.Run("returns false for production", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "production"}}
+		assert.False(t, cfg.IsDevelopment())
+	})
+
+	t.Run("returns false for staging", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "staging"}}
+		assert.False(t, cfg.IsDevelopment())
+	})
+
+	t.Run("returns false for local", func(t *testing.T) {
+		// "local" は "development" と等しくないため false を返す
+		cfg := &Config{App: AppConfig{Env: "local"}}
+		assert.False(t, cfg.IsDevelopment())
+	})
+
+	t.Run("returns false for empty string", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: ""}}
+		assert.False(t, cfg.IsDevelopment())
+	})
+}
+
+// TestConfigIsProduction 验证 IsProduction() 对各环境值的行为
+func TestConfigIsProduction(t *testing.T) {
+	t.Run("returns true for production", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "production"}}
+		assert.True(t, cfg.IsProduction())
+	})
+
+	t.Run("returns false for development", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "development"}}
+		assert.False(t, cfg.IsProduction())
+	})
+
+	t.Run("returns false for local", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "local"}}
+		assert.False(t, cfg.IsProduction())
+	})
+
+	t.Run("returns false for staging", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: "staging"}}
+		assert.False(t, cfg.IsProduction())
+	})
+
+	t.Run("returns false for empty string", func(t *testing.T) {
+		cfg := &Config{App: AppConfig{Env: ""}}
+		assert.False(t, cfg.IsProduction())
+	})
+}
+
+// TestConfigStructDefaults 验证 setDefaults 写入的默认值与源码一致
+// 不依赖文件系统，直接构造 viper 实例并调用包内 setDefaults 函数
+func TestConfigStructDefaults(t *testing.T) {
+	v := viper.New()
+	setDefaults(v)
+
+	t.Run("app defaults", func(t *testing.T) {
+		assert.Equal(t, "ai-chat-platform", v.GetString("app.name"))
+		assert.Equal(t, 3000, v.GetInt("app.port"))
+		assert.Equal(t, "0.0.0.0", v.GetString("app.host"))
+		assert.Equal(t, "development", v.GetString("app.env"))
+	})
+
+	t.Run("database defaults", func(t *testing.T) {
+		assert.Equal(t, "localhost", v.GetString("database.host"))
+		assert.Equal(t, 5432, v.GetInt("database.port"))
+		assert.Equal(t, "postgres", v.GetString("database.username"))
+		assert.Equal(t, "", v.GetString("database.password"))
+		assert.Equal(t, "ai_chat_platform", v.GetString("database.name"))
+		assert.False(t, v.GetBool("database.ssl"))
+		assert.False(t, v.GetBool("database.logging"))
+		assert.Equal(t, 25, v.GetInt("database.max_open_conns"))
+		assert.Equal(t, 10, v.GetInt("database.max_idle_conns"))
+	})
+
+	t.Run("redis defaults", func(t *testing.T) {
+		assert.Equal(t, "localhost", v.GetString("redis.host"))
+		assert.Equal(t, 6379, v.GetInt("redis.port"))
+		assert.Equal(t, "", v.GetString("redis.password"))
+		assert.Equal(t, 0, v.GetInt("redis.db"))
+	})
+
+	t.Run("identity access token defaults", func(t *testing.T) {
+		assert.Equal(t, "http://localhost:3002", v.GetString("identity.access_token.issuer"))
+		assert.Equal(t, "onex-local-2026-07", v.GetString("identity.access_token.signing_key_id"))
+		assert.Equal(t, "", v.GetString("identity.access_token.private_key_path"))
+		var cfg Config
+		require.NoError(t, v.Unmarshal(&cfg))
+		assert.Len(t, cfg.Identity.Clients, 1)
+		assert.Equal(t, "platform", cfg.Identity.Clients["admin-web"].ProductCode)
+		assert.Equal(t, "admin_web", cfg.Identity.Clients["admin-web"].ApplicationCode)
+		assert.ElementsMatch(t, []string{"user"}, cfg.Identity.Clients["admin-web"].AllowedPrincipalTypes)
+		assert.ElementsMatch(t, []string{"openid", "profile"}, cfg.Identity.AccessToken.Resources["platform"].GuestScopes)
+		assert.Contains(t, cfg.Identity.AccessToken.Resources, "platform")
+		assert.NotContains(t, cfg.Identity.AccessToken.Resources, "onex")
+		assert.Equal(t, "http://localhost:3002", cfg.Identity.AccessToken.ProtectedResources["platform_internal_api"].ResourceIdentifier)
+		assert.Equal(t, serviceidentity.AudiencePlatformInternalAPI, cfg.Identity.AccessToken.ProtectedResources["platform_internal_api"].Audience)
+	})
+
+	t.Run("openai defaults", func(t *testing.T) {
+		assert.Equal(t, "", v.GetString("openai.api_key"))
+		assert.Equal(t, "gpt-4", v.GetString("openai.model"))
+		assert.Equal(t, "https://api.openai.com/v1", v.GetString("openai.base_url"))
+	})
+
+	t.Run("anthropic defaults", func(t *testing.T) {
+		assert.Equal(t, "", v.GetString("anthropic.api_key"))
+		assert.Equal(t, "claude-3-opus-20240229", v.GetString("anthropic.model"))
+	})
+
+	t.Run("log defaults", func(t *testing.T) {
+		assert.Equal(t, "debug", v.GetString("log.level"))
+		assert.Equal(t, "development", v.GetString("log.env"))
+		assert.Equal(t, "debug", v.GetString("log.request_success_level"))
+		assert.InDelta(t, 0.0, v.GetFloat64("log.request_success_sample_rate"), 0.001)
+		assert.Equal(t, "2s", v.GetString("log.request_slow_threshold"))
+	})
+
+	t.Run("audit access log defaults", func(t *testing.T) {
+		assert.True(t, v.GetBool("audit.access_log.enabled"))
+		assert.InDelta(t, 0.05, v.GetFloat64("audit.access_log.success_read_sample_rate"), 0.001)
+		assert.Equal(t, "2s", v.GetString("audit.access_log.slow_request_threshold"))
+		assert.True(t, v.GetBool("audit.access_log.record_write_methods"))
+		assert.True(t, v.GetBool("audit.access_log.record_client_errors"))
+	})
+
+	t.Run("throttle defaults", func(t *testing.T) {
+		assert.Equal(t, 60, v.GetInt("throttle.ttl"))
+		assert.Equal(t, 100, v.GetInt("throttle.limit"))
+	})
+
+	t.Run("internal service defaults", func(t *testing.T) {
+		assert.Equal(t, "http://platform-api:3002/internal/v1", v.GetString("internal_service.platform_base_url"))
+		assert.Equal(t, "http://documentation-api:3010/api/v1/documentation", v.GetString("internal_service.documentation_base_url"))
+		assert.Equal(t, "iam-service-local-2026-08", v.GetString("internal_service.service_token_signing.key_id"))
+		assert.Empty(t, v.GetStringMap("internal_service.outbound_identities"))
+		assert.Equal(t, defaultInternalServiceTokenTTLSeconds, v.GetInt("internal_service.token_ttl_seconds"))
+		assert.Equal(t, defaultIAMConsistencyTokenTTLSeconds, v.GetInt("internal_service.authorization_consistency_token_ttl_seconds"))
+		assert.Equal(t, "5m0s", v.GetString("identity.access_token.delegated_token_ttl"))
+	})
+
+	t.Run("documentation privacy defaults", func(t *testing.T) {
+		assert.Equal(t, "env://DOCUMENTATION_PRIVACY_HMAC_KEY", v.GetString("documentation.privacy_hmac_key_ref"))
+	})
+
+	t.Run("API contract compatibility evaluator defaults", func(t *testing.T) {
+		assert.Equal(t, "oasdiff", v.GetString("api_contract.compatibility_evaluator.executable"))
+		assert.Equal(t, "2m", v.GetString("api_contract.compatibility_evaluator.timeout"))
+	})
+
+	t.Run("product admin defaults", func(t *testing.T) {
+		assert.Empty(t, v.GetStringMap("product_admin.targets"))
+	})
+
+	t.Run("export defaults", func(t *testing.T) {
+		assert.Equal(t, "/tmp/exports", v.GetString("export.local_dir"))
+		assert.Equal(t, "exports", v.GetString("export.path_prefix"))
+	})
+
+	t.Run("tracing defaults", func(t *testing.T) {
+		assert.False(t, v.GetBool("tracing.enabled"))
+		assert.Equal(t, "localhost:4318", v.GetString("tracing.endpoint"))
+		assert.Equal(t, "onex-backend", v.GetString("tracing.service_name"))
+		assert.Equal(t, "1.0.0", v.GetString("tracing.service_version"))
+		assert.Equal(t, "development", v.GetString("tracing.environment"))
+		assert.InDelta(t, 1.0, v.GetFloat64("tracing.sampling_ratio"), 0.001)
+	})
+
+	t.Run("clamav defaults", func(t *testing.T) {
+		assert.False(t, v.GetBool("clamav.enabled"))
+		assert.Equal(t, "tcp://localhost:3310", v.GetString("clamav.address"))
+		assert.Equal(t, 30, v.GetInt("clamav.timeout"))
+	})
+
+	t.Run("communication reputation defaults", func(t *testing.T) {
+		assert.Equal(t, []string{"zen.spamhaus.org"}, v.GetStringSlice("communication.reputation.ip_blocklist_zones"))
+		assert.Equal(t, []string{"dbl.spamhaus.org"}, v.GetStringSlice("communication.reputation.domain_blocklist_zones"))
+		assert.Equal(t, 5, v.GetInt("communication.reputation.dns_lookup_timeout_seconds"))
+		assert.Equal(t, 24, v.GetInt("communication.reputation.recheck_interval_hours"))
+		assert.Equal(t, 50, v.GetInt("communication.reputation.recheck_batch_limit"))
+	})
+
+	t.Run("temporal defaults", func(t *testing.T) {
+		assert.False(t, v.GetBool("temporal.enabled"))
+		assert.Equal(t, "", v.GetString("temporal.host_port"))
+		assert.Equal(t, "", v.GetString("temporal.namespace"))
+		assert.False(t, v.GetBool("temporal.tls.enabled"))
+		assert.Equal(t, "", v.GetString("temporal.tls.server_name"))
+		assert.False(t, v.GetBool("temporal.tls.disable_host_verification"))
+		assert.Equal(t, "", v.GetString("temporal.tls.ca_path"))
+		assert.Equal(t, "", v.GetString("temporal.tls.cert_path"))
+		assert.Equal(t, "", v.GetString("temporal.tls.key_path"))
+		assert.Equal(t, 4, v.GetInt("temporal.worker.max_concurrent_activities"))
+		assert.Equal(t, 16, v.GetInt("temporal.worker.max_concurrent_workflow_tasks"))
+		assert.Equal(t, 2, v.GetInt("temporal.worker.max_concurrent_activity_task_pollers"))
+		assert.Equal(t, 2, v.GetInt("temporal.worker.max_concurrent_workflow_task_pollers"))
+	})
+
+	t.Run("kafka defaults", func(t *testing.T) {
+		assert.Equal(t, "localhost:9092", v.GetString("kafka.brokers"))
+		assert.Equal(t, "ai-chat-platform", v.GetString("kafka.client_id"))
+		assert.Equal(t, "ai-chat-api-consumer", v.GetString("kafka.group_id"))
+		assert.Equal(t, 10000, v.GetInt("kafka.connection_timeout"))
+		assert.Equal(t, 10000, v.GetInt("kafka.authentication_timeout"))
+		assert.Equal(t, 30000, v.GetInt("kafka.request_timeout"))
+		assert.Equal(t, "plain", v.GetString("kafka.sasl_mechanism"))
+		assert.False(t, v.GetBool("kafka.ssl_enabled"))
+	})
+}
+
+func TestSecretConfigUsesDeploymentSelectedDriverAndKeys(t *testing.T) {
+	v := viper.New()
+	setDefaults(v)
+	t.Setenv("SECRET_ACTIVE_DRIVER_CODE", "envelope_aead")
+	t.Setenv("SECRET_FINGERPRINT_KEY", strings.Repeat("f", 32))
+	t.Setenv("SECRET_DRIVER_HEALTH_TIMEOUT", "7s")
+	t.Setenv("SECRET_ENVELOPE_DRIVER_CODE", "envelope_aead")
+	t.Setenv("SECRET_ENVELOPE_MAXIMUM_PLAINTEXT_BYTES", "131072")
+	t.Setenv("SECRET_RUNTIME_SERVICE_ACCOUNT_CODE", "svc_platform_api_prod")
+	t.Setenv("SECRET_RUNTIME_AUDIENCE", "urn:onex:resource:platform-internal-api")
+	t.Setenv("SECRET_RUNTIME_DEFAULT_PRODUCT_CODE", "platform")
+	t.Setenv("SECRET_RUNTIME_LEASE_TTL", "45s")
+	t.Setenv("SECRET_MINIMUM_DESTRUCTION_DELAY", "48h")
+	t.Setenv("SECRET_ACCESS_EVENT_PURGE_ENABLED", "true")
+	t.Setenv("SECRET_WORKER_SERVICE_ACCOUNT_CODE", "svc_secret_worker")
+	t.Setenv("SECRET_WORKER_BATCH_SIZE", "80")
+	t.Setenv("SECRET_WORKER_PARTITION_MONTHS_AHEAD", "4")
+	require.NoError(t, bindEnvVars(v))
+
+	var cfg Config
+	require.NoError(t, v.Unmarshal(&cfg))
+	assert.Equal(t, "envelope_aead", cfg.Secret.ActiveDriverCode)
+	assert.Equal(t, strings.Repeat("f", 32), cfg.Secret.FingerprintKey)
+	assert.Equal(t, 7*time.Second, cfg.Secret.DriverHealthTimeout)
+	assert.Equal(t, "envelope_aead", cfg.Secret.Envelope.DriverCode)
+	assert.Equal(t, 131072, cfg.Secret.Envelope.MaximumPlaintextBytes)
+	assert.Equal(t, "svc_platform_api_prod", cfg.Secret.Runtime.ServiceAccountCode)
+	assert.Equal(t, "urn:onex:resource:platform-internal-api", cfg.Secret.Runtime.Audience)
+	assert.Equal(t, "platform", cfg.Secret.Runtime.DefaultProductCode)
+	assert.Equal(t, 45*time.Second, cfg.Secret.Runtime.LeaseTTL)
+	assert.Equal(t, 48*time.Hour, cfg.Secret.Retention.MinimumDestructionDelay)
+	assert.True(t, cfg.Secret.Retention.AccessEventPurgeEnabled)
+	assert.Equal(t, "svc_secret_worker", cfg.Secret.Worker.ServiceAccountCode)
+	assert.Equal(t, 80, cfg.Secret.Worker.BatchSize)
+	assert.Equal(t, 4, cfg.Secret.Worker.PartitionMonthsAhead)
+}
+
+func TestSecretConfigHasNoDefaultDriverOrKey(t *testing.T) {
+	v := viper.New()
+	setDefaults(v)
+
+	assert.Empty(t, v.GetString("secret.active_driver_code"))
+	assert.Empty(t, v.GetString("secret.envelope.driver_code"))
+	assert.Empty(t, v.GetString("secret.fingerprint_key"))
+	assert.Empty(t, v.GetString("secret.runtime.service_account_code"))
+	assert.Empty(t, v.GetString("secret.runtime.audience"))
+	assert.Empty(t, v.GetString("secret.worker.service_account_code"))
+}
+
+func TestValidateSecretBrokerConfig(t *testing.T) {
+	valid := func() SecretConfig {
+		return SecretConfig{
+			ActiveDriverCode:    "envelope_aead",
+			FingerprintKey:      strings.Repeat("f", 32),
+			DriverHealthTimeout: 5 * time.Second,
+			Envelope: SecretEnvelopeDriverConfig{
+				DriverCode:            "envelope_aead",
+				MaximumPlaintextBytes: 256 * 1024,
+			},
+			Runtime: SecretRuntimeIdentityConfig{
+				ServiceAccountCode: "svc_platform_api_prod",
+				Audience:           "urn:onex:resource:platform-internal-api",
+				DefaultProductCode: "platform",
+				LeaseTTL:           30 * time.Second,
+			},
+			Retention: SecretRetentionConfig{
+				MinimumDestructionDelay: 24 * time.Hour,
+			},
+			Worker: SecretWorkerConfig{
+				ServiceAccountCode:   "svc_secret_worker",
+				BatchSize:            100,
+				PartitionMonthsAhead: 3,
+			},
+		}
+	}
+
+	require.NoError(t, validateSecretBrokerConfig("platform-api", SecretConfig{}))
+	require.NoError(t, validateSecretBrokerConfig("worker", valid()))
+	apiConfig := valid()
+	apiConfig.Worker = SecretWorkerConfig{}
+	require.NoError(t, validateSecretBrokerConfig("platform-api", apiConfig))
+	require.ErrorContains(t, validateSecretBrokerConfig("worker", apiConfig), "SECRET_WORKER_SERVICE_ACCOUNT_CODE")
+
+	tests := []struct {
+		name   string
+		mutate func(*SecretConfig)
+		want   string
+	}{
+		{name: "active driver", mutate: func(cfg *SecretConfig) { cfg.ActiveDriverCode = "" }, want: "SECRET_ACTIVE_DRIVER_CODE"},
+		{name: "envelope driver", mutate: func(cfg *SecretConfig) { cfg.Envelope.DriverCode = " envelope_aead " }, want: "SECRET_ENVELOPE_DRIVER_CODE"},
+		{name: "fingerprint key", mutate: func(cfg *SecretConfig) { cfg.FingerprintKey = "short" }, want: "SECRET_FINGERPRINT_KEY"},
+		{name: "health timeout", mutate: func(cfg *SecretConfig) { cfg.DriverHealthTimeout = 31 * time.Second }, want: "SECRET_DRIVER_HEALTH_TIMEOUT"},
+		{name: "plaintext limit", mutate: func(cfg *SecretConfig) { cfg.Envelope.MaximumPlaintextBytes = 256*1024 + 1 }, want: "SECRET_ENVELOPE_MAXIMUM_PLAINTEXT_BYTES"},
+		{name: "runtime service account", mutate: func(cfg *SecretConfig) { cfg.Runtime.ServiceAccountCode = "platform-api" }, want: "SECRET_RUNTIME_SERVICE_ACCOUNT_CODE"},
+		{name: "runtime audience", mutate: func(cfg *SecretConfig) { cfg.Runtime.Audience = "platform-api" }, want: "SECRET_RUNTIME_AUDIENCE"},
+		{name: "runtime product", mutate: func(cfg *SecretConfig) { cfg.Runtime.DefaultProductCode = "Platform" }, want: "SECRET_RUNTIME_DEFAULT_PRODUCT_CODE"},
+		{name: "runtime lease TTL", mutate: func(cfg *SecretConfig) { cfg.Runtime.LeaseTTL = 5 * time.Second }, want: "SECRET_RUNTIME_LEASE_TTL"},
+		{name: "retention delay", mutate: func(cfg *SecretConfig) { cfg.Retention.MinimumDestructionDelay = 31 * 24 * time.Hour }, want: "SECRET_MINIMUM_DESTRUCTION_DELAY"},
+		{name: "worker service account", mutate: func(cfg *SecretConfig) { cfg.Worker.ServiceAccountCode = "secret-worker" }, want: "SECRET_WORKER_SERVICE_ACCOUNT_CODE"},
+		{name: "worker batch", mutate: func(cfg *SecretConfig) { cfg.Worker.BatchSize = 501 }, want: "SECRET_WORKER_BATCH_SIZE"},
+		{name: "partition horizon", mutate: func(cfg *SecretConfig) { cfg.Worker.PartitionMonthsAhead = 25 }, want: "SECRET_WORKER_PARTITION_MONTHS_AHEAD"},
+	}
+	for _, testCase := range tests {
+		t.Run(testCase.name, func(t *testing.T) {
+			cfg := valid()
+			testCase.mutate(&cfg)
+			err := validateSecretBrokerConfig("worker", cfg)
+			require.ErrorContains(t, err, testCase.want)
+		})
+	}
+}
+
+func TestValidateIdentityClientRegistry(t *testing.T) {
+	newConfig := func() *Config {
+		return &Config{
+			App:      AppConfig{Name: "platform-api", Env: "production", Port: 3000},
+			Identity: validIdentityRuntimeConfigForTest(),
+		}
+	}
+
+	tests := []struct {
+		name        string
+		mutate      func(*Config)
+		wantMessage string
+	}{
+		{
+			name: "empty client registry",
+			mutate: func(cfg *Config) {
+				cfg.Identity.Clients = nil
+			},
+			wantMessage: "identity.clients requires at least one client",
+		},
+		{
+			name: "client id with whitespace",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				delete(cfg.Identity.Clients, "product-alpha-web")
+				cfg.Identity.Clients[" product-alpha-web "] = client
+			},
+			wantMessage: "client id",
+		},
+		{
+			name: "client id with underscore",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				delete(cfg.Identity.Clients, "product-alpha-web")
+				cfg.Identity.Clients["product_alpha_web"] = client
+			},
+			wantMessage: "client id",
+		},
+		{
+			name: "unknown client product",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.ProductCode = "unknown"
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "references unknown resource",
+		},
+		{
+			name: "registration source with whitespace",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.RegistrationSource = " product_alpha_web "
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "registration_source is invalid",
+		},
+		{
+			name: "empty application code",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.ApplicationCode = ""
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "application_code is invalid",
+		},
+		{
+			name: "application code with whitespace",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.ApplicationCode = " consumer_web "
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "application_code is invalid",
+		},
+		{
+			name: "empty allowed principal types",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.AllowedPrincipalTypes = nil
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "requires at least one principal type",
+		},
+		{
+			name: "invalid allowed principal type",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.AllowedPrincipalTypes = []string{"service"}
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "invalid principal type",
+		},
+		{
+			name: "duplicate allowed principal type",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.AllowedPrincipalTypes = []string{"user", "user"}
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "duplicate principal type",
+		},
+		{
+			name: "duplicate resource audience",
+			mutate: func(cfg *Config) {
+				cfg.Identity.AccessToken.Resources["product_beta"] = IdentityAccessTokenResourceConfig{
+					Audience:    "urn:onex:resource:product_alpha-api",
+					UserScopes:  []string{"email", "openid", "profile"},
+					GuestScopes: []string{"openid", "profile"},
+				}
+			},
+			wantMessage: "duplicates resource",
+		},
+		{
+			name: "empty protected resource registry",
+			mutate: func(cfg *Config) {
+				cfg.Identity.AccessToken.ProtectedResources = nil
+			},
+			wantMessage: "protected_resources requires at least one resource",
+		},
+		{
+			name: "insecure protected resource in production",
+			mutate: func(cfg *Config) {
+				resource := cfg.Identity.AccessToken.ProtectedResources["platform_internal_api"]
+				resource.ResourceIdentifier = "http://localhost:3002"
+				cfg.Identity.AccessToken.ProtectedResources["platform_internal_api"] = resource
+			},
+			wantMessage: "must use https in production",
+		},
+		{
+			name: "duplicate protected resource identifier",
+			mutate: func(cfg *Config) {
+				cfg.Identity.AccessToken.ProtectedResources["documentation_api"] = IdentityProtectedResourceConfig{
+					ResourceIdentifier: "https://api.example.com",
+					Audience:           serviceidentity.AudienceDocumentationAPI,
+					ResourceName:       "OneX Documentation API",
+				}
+			},
+			wantMessage: "resource_identifier duplicates resource",
+		},
+		{
+			name: "invalid token exchange actor",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.TokenExchangeServiceAccounts = []string{"product-alpha-bff"}
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "invalid service account",
+		},
+		{
+			name: "identity token service cannot be target resource",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.TokenExchangeResources = []string{"urn:onex:resource:identity-token-service"}
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "invalid audience",
+		},
+		{
+			name: "token exchange actors and resources are paired",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.TokenExchangeResources = nil
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "configured together",
+		},
+		{
+			name: "unknown token exchange resource",
+			mutate: func(cfg *Config) {
+				client := cfg.Identity.Clients["product-alpha-web"]
+				client.TokenExchangeResources = []string{"urn:onex:resource:unregistered-api"}
+				cfg.Identity.Clients["product-alpha-web"] = client
+			},
+			wantMessage: "references unknown protected resource audience",
+		},
+	}
+
+	for _, testCase := range tests {
+		t.Run(testCase.name, func(t *testing.T) {
+			cfg := newConfig()
+			testCase.mutate(cfg)
+			err := validateIdentityAccessTokenConfig(cfg)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), testCase.wantMessage)
+		})
+	}
+
+	assert.NoError(t, validateIdentityAccessTokenConfig(newConfig()))
+}
+
+// TestConfigValidate 验证 validate() 对必填字段的校验逻辑
+func TestConfigValidate(t *testing.T) {
+	t.Run("returns error when OAuth state signing secret is empty", func(t *testing.T) {
+		identity := validIdentityRuntimeConfigForTest()
+		identity.OAuthStateSigningSecret = ""
+		cfg := &Config{
+			App:             AppConfig{Name: "platform-api", Port: 3000},
+			Identity:        identity,
+			InternalService: validInternalServiceConfigForTest(),
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "IDENTITY_OAUTH_STATE_SIGNING_SECRET")
+	})
+
+	t.Run("returns error when port is 0", func(t *testing.T) {
+		cfg := &Config{
+			App:      AppConfig{Port: 0},
+			Identity: validIdentityRuntimeConfigForTest(),
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "APP_PORT")
+	})
+
+	t.Run("returns error when port is negative", func(t *testing.T) {
+		cfg := &Config{
+			App:      AppConfig{Port: -1},
+			Identity: validIdentityRuntimeConfigForTest(),
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "APP_PORT")
+	})
+
+	t.Run("returns error when port exceeds 65535", func(t *testing.T) {
+		cfg := &Config{
+			App:      AppConfig{Port: 65536},
+			Identity: validIdentityRuntimeConfigForTest(),
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "APP_PORT")
+	})
+
+	t.Run("returns nil when all required fields are valid", func(t *testing.T) {
+		cfg := &Config{
+			App:             AppConfig{Name: "platform-api", Env: "production", Port: 3000},
+			Identity:        validIdentityRuntimeConfigForTest(),
+			FeatureFlag:     validFeatureFlagConfigForTest(),
+			InternalService: validInternalServiceConfigForTest(),
+			Documentation:   DocumentationConfig{PrivacyHMACKeyRef: "env://DOCUMENTATION_PRIVACY_HMAC_KEY"},
+		}
+		assert.NoError(t, validate(cfg))
+	})
+
+	t.Run("returns nil when admin verifier omits private signing key", func(t *testing.T) {
+		identity := validIdentityRuntimeConfigForTest()
+		identity.AccessToken.PrivateKeyPath = ""
+		cfg := &Config{
+			App:             AppConfig{Name: "admin-api", Env: "production", Port: 3000},
+			Identity:        identity,
+			FeatureFlag:     validFeatureFlagConfigForTest(),
+			InternalService: validInternalServiceConfigForTest(),
+		}
+		assert.NoError(t, validate(cfg))
+	})
+
+	t.Run("returns error when platform phone hash key is empty", func(t *testing.T) {
+		cfg := &Config{
+			App: AppConfig{Name: "platform-api", Port: 3000},
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "IDENTITY_PHONE_HASH_KEY")
+	})
+
+	t.Run("returns error when admin phone hash key is too short", func(t *testing.T) {
+		cfg := &Config{
+			App:      AppConfig{Name: "admin-api", Port: 3000},
+			Identity: IdentityConfig{PhoneHashKey: "short-phone-hash-key"},
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "IDENTITY_PHONE_HASH_KEY")
+	})
+
+	t.Run("returns error when worker phone hash key is placeholder", func(t *testing.T) {
+		cfg := &Config{
+			App:      AppConfig{Name: "worker", Port: 3000},
+			Identity: IdentityConfig{PhoneHashKey: "change-me-phone-hash-key-min-32chars"},
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "IDENTITY_PHONE_HASH_KEY")
+	})
+
+	t.Run("returns nil for boundary port 1", func(t *testing.T) {
+		cfg := &Config{
+			App:             AppConfig{Port: 1},
+			Identity:        validIdentityRuntimeConfigForTest(),
+			InternalService: validInternalServiceConfigForTest(),
+		}
+		assert.NoError(t, validate(cfg))
+	})
+
+	t.Run("returns nil for boundary port 65535", func(t *testing.T) {
+		cfg := &Config{
+			App:             AppConfig{Port: 65535},
+			Identity:        validIdentityRuntimeConfigForTest(),
+			InternalService: validInternalServiceConfigForTest(),
+		}
+		assert.NoError(t, validate(cfg))
+	})
+
+	t.Run("returns error when temporal workflow task concurrency is unsupported", func(t *testing.T) {
+		cfg := &Config{
+			App:             AppConfig{Port: 3000},
+			Identity:        validIdentityRuntimeConfigForTest(),
+			InternalService: validInternalServiceConfigForTest(),
+			Temporal: TemporalConfig{
+				Worker: TemporalWorkerConfig{
+					MaxConcurrentWorkflowTasks:       1,
+					MaxConcurrentWorkflowTaskPollers: 2,
+				},
+			},
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASKS")
+	})
+
+	t.Run("returns error when temporal workflow poller concurrency is unsupported", func(t *testing.T) {
+		cfg := &Config{
+			App:             AppConfig{Port: 3000},
+			Identity:        validIdentityRuntimeConfigForTest(),
+			InternalService: validInternalServiceConfigForTest(),
+			Temporal: TemporalConfig{
+				Worker: TemporalWorkerConfig{
+					MaxConcurrentWorkflowTasks:       16,
+					MaxConcurrentWorkflowTaskPollers: 1,
+				},
+			},
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS")
+	})
+
+	t.Run("returns error when IAM signing key id is invalid", func(t *testing.T) {
+		cfg := validInternalServiceRuntimeConfigForTest()
+		cfg.InternalService.ServiceTokenSigning = ServiceTokenSigningConfig{
+			KeyID: "invalid key id", PublicKeyDirectory: testServiceTokenPublicKeyDirectory,
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "ONEX_IAM_SERVICE_TOKEN_SIGNING_KEY_ID")
+	})
+
+	t.Run("returns error when outbound identity credential ref is template", func(t *testing.T) {
+		cfg := validInternalServiceRuntimeConfigForTest()
+		identity := cfg.InternalService.OutboundIdentities["platform"]
+		identity.CredentialRef = "replace-with-bootstrap-ref"
+		cfg.InternalService.OutboundIdentities["platform"] = identity
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "credential_ref")
+	})
+
+	t.Run("returns error when token ttl is below minimum", func(t *testing.T) {
+		cfg := validInternalServiceRuntimeConfigForTest()
+		cfg.InternalService.TokenTTLSeconds = 0
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "ONEX_IAM_SERVICE_TOKEN_TTL_SECONDS")
+	})
+
+	t.Run("returns error when token ttl exceeds maximum", func(t *testing.T) {
+		cfg := validInternalServiceRuntimeConfigForTest()
+		cfg.InternalService.TokenTTLSeconds = maxInternalServiceTokenTTLSeconds + 1
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "ONEX_IAM_SERVICE_TOKEN_TTL_SECONDS")
+	})
+
+	t.Run("returns nil for token ttl bounds", func(t *testing.T) {
+		for _, ttl := range []int{1, maxInternalServiceTokenTTLSeconds} {
+			cfg := validInternalServiceRuntimeConfigForTest()
+			cfg.InternalService.TokenTTLSeconds = ttl
+			assert.NoError(t, validate(cfg))
+		}
+	})
+
+	t.Run("returns error when temporal provider poll worker concurrency is unsupported", func(t *testing.T) {
+		cfg := &Config{
+			App:             AppConfig{Port: 3000},
+			InternalService: validInternalServiceConfigForTest(),
+			Temporal: TemporalConfig{
+				ProviderPollWorker: TemporalWorkerConfig{
+					MaxConcurrentWorkflowTasks: 1,
+				},
+			},
+		}
+		err := validate(cfg)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_WORKFLOW_TASKS")
+	})
+}
+
+// TestConfigLoadEnvOverride 验证 Load() 通过环境变量覆盖默认值
+// Load() 会静默忽略找不到的配置文件，所以可以在无配置文件的环境中安全运行
+func TestConfigLoadEnvOverride(t *testing.T) {
+	t.Setenv("APP_ENV", "production")
+	t.Setenv("IDENTITY_PHONE_HASH_KEY", "abcdef0123456789abcdef0123456789")
+	t.Setenv("IDENTITY_OAUTH_STATE_SIGNING_SECRET", "oauth-state-env-secret-key-at-least-32-bytes")
+	t.Setenv("IDENTITY_ACCESS_TOKEN_ISSUER", "https://identity.example.com")
+	t.Setenv("IDENTITY_ACCESS_TOKEN_SIGNING_KEY_ID", "identity-key-2026-07")
+	t.Setenv("IDENTITY_ACCESS_TOKEN_PRIVATE_KEY_PATH", "/run/secrets/identity-access-token-private.pem")
+	t.Setenv("IDENTITY_ACCESS_TOKEN_PUBLIC_KEY_DIRECTORY", "/run/secrets/identity-access-token-public")
+	t.Setenv("ONEX_IDENTITY_PROTECTED_RESOURCES", `{"platform_internal_api":{"resource_identifier":"https://api.example.com","audience":"urn:onex:resource:platform-internal-api","resource_name":"OneX Platform Internal API"},"documentation_api":{"resource_identifier":"https://documentation-api.example.com","audience":"urn:onex:resource:documentation-api","resource_name":"OneX Documentation API"}}`)
+	t.Setenv("IDENTITY_GUEST_CAPABILITY_SECRET_PROVIDER_FILE", "/run/secrets/identity-guest-capability.json")
+	t.Setenv("IDENTITY_GUEST_CAPABILITY_INITIAL_KEY_ID", "guest-capability-2026-07")
+	t.Setenv("IDENTITY_GUEST_CAPABILITY_VERIFIER_INSTANCE_ID", "platform-api-1")
+	t.Setenv("APP_PORT", "8080")
+	t.Setenv("APP_NAME", "platform-api")
+	t.Setenv("REDIS_HOST", "redis.example.com")
+	t.Setenv("DATABASE_HOST", "db.example.com")
+	t.Setenv("OPENAI_MODEL", "gpt-4o")
+	t.Setenv("TEMPORAL_ENABLED", "true")
+	t.Setenv("TEMPORAL_HOST_PORT", "temporal.example.com:7233")
+	t.Setenv("TEMPORAL_NAMESPACE", "onex-prod")
+	t.Setenv("TEMPORAL_TLS_ENABLED", "true")
+	t.Setenv("TEMPORAL_TLS_SERVER_NAME", "temporal.example.com")
+	t.Setenv("TEMPORAL_WORKER_MAX_CONCURRENT_ACTIVITIES", "3")
+	t.Setenv("TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASKS", "18")
+	t.Setenv("TEMPORAL_WORKER_MAX_CONCURRENT_ACTIVITY_TASK_POLLERS", "4")
+	t.Setenv("TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS", "6")
+	t.Setenv("TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_ACTIVITIES", "12")
+	t.Setenv("TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_WORKFLOW_TASKS", "20")
+	t.Setenv("TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_ACTIVITY_TASK_POLLERS", "5")
+	t.Setenv("TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS", "8")
+	t.Setenv("AUDIT_ACCESS_LOG_SUCCESS_READ_SAMPLE_RATE", "0.25")
+	t.Setenv("AUDIT_ACCESS_LOG_SLOW_REQUEST_THRESHOLD", "3s")
+	t.Setenv("ONEX_IAM_SERVICE_TOKEN_SIGNING_KEY_ID", "iam-service-key-2026-08")
+	t.Setenv("ONEX_IAM_SERVICE_TOKEN_PRIVATE_KEY_PATH", testServiceTokenPrivateKeyPath)
+	t.Setenv("ONEX_IAM_SERVICE_TOKEN_PUBLIC_KEY_DIRECTORY", testServiceTokenPublicKeyDirectory)
+	t.Setenv("ONEX_INTERNAL_SERVICE_OUTBOUND_IDENTITIES", `{"documentation":{"credential_ref":"`+testBootstrapCredentialRef+`","allowed_product_codes":["platform"],"audience":"urn:onex:resource:documentation-api","expected_service_account_code":"svc_ai_documentation_prod"}}`)
+	t.Setenv("ONEX_IAM_SERVICE_TOKEN_TTL_SECONDS", "600")
+
+	cfg, err := Load()
+	require.NoError(t, err)
+
+	assert.Equal(t, "production", cfg.App.Env)
+	assert.Equal(t, "abcdef0123456789abcdef0123456789", cfg.Identity.PhoneHashKey)
+	assert.Equal(t, "oauth-state-env-secret-key-at-least-32-bytes", cfg.Identity.OAuthStateSigningSecret)
+	assert.Equal(t, "https://identity.example.com", cfg.Identity.AccessToken.Issuer)
+	assert.Equal(t, "identity-key-2026-07", cfg.Identity.AccessToken.SigningKeyID)
+	assert.Equal(t, "/run/secrets/identity-access-token-private.pem", cfg.Identity.AccessToken.PrivateKeyPath)
+	assert.Equal(t, "/run/secrets/identity-access-token-public", cfg.Identity.AccessToken.PublicKeyDirectory)
+	assert.Equal(t, "/run/secrets/identity-guest-capability.json", cfg.Identity.GuestCapability.SecretProviderFile)
+	assert.Equal(t, "guest-capability-2026-07", cfg.Identity.GuestCapability.InitialKeyID)
+	assert.Equal(t, "platform-api-1", cfg.Identity.GuestCapability.VerifierInstanceID)
+	assert.Equal(t, 8080, cfg.App.Port)
+	assert.Equal(t, "platform-api", cfg.App.Name)
+	assert.Equal(t, "redis.example.com", cfg.Redis.Host)
+	assert.Equal(t, "db.example.com", cfg.Database.Host)
+	assert.Equal(t, "gpt-4o", cfg.OpenAI.Model)
+	assert.True(t, cfg.Temporal.Enabled)
+	assert.Equal(t, "temporal.example.com:7233", cfg.Temporal.HostPort)
+	assert.Equal(t, "onex-prod", cfg.Temporal.Namespace)
+	assert.True(t, cfg.Temporal.TLS.Enabled)
+	assert.Equal(t, "temporal.example.com", cfg.Temporal.TLS.ServerName)
+	assert.Equal(t, 3, cfg.Temporal.Worker.MaxConcurrentActivities)
+	assert.Equal(t, 18, cfg.Temporal.Worker.MaxConcurrentWorkflowTasks)
+	assert.Equal(t, 4, cfg.Temporal.Worker.MaxConcurrentActivityTaskPollers)
+	assert.Equal(t, 6, cfg.Temporal.Worker.MaxConcurrentWorkflowTaskPollers)
+	assert.Equal(t, 12, cfg.Temporal.ProviderPollWorker.MaxConcurrentActivities)
+	assert.Equal(t, 20, cfg.Temporal.ProviderPollWorker.MaxConcurrentWorkflowTasks)
+	assert.Equal(t, 5, cfg.Temporal.ProviderPollWorker.MaxConcurrentActivityTaskPollers)
+	assert.Equal(t, 8, cfg.Temporal.ProviderPollWorker.MaxConcurrentWorkflowTaskPollers)
+	assert.InDelta(t, 0.25, cfg.Audit.AccessLog.SuccessReadSampleRate, 0.001)
+	assert.Equal(t, "3s", cfg.Audit.AccessLog.SlowRequestThreshold.String())
+	assert.Equal(t, "iam-service-key-2026-08", cfg.InternalService.ServiceTokenSigning.KeyID)
+	assert.Equal(t, testServiceTokenPrivateKeyPath, cfg.InternalService.ServiceTokenSigning.PrivateKeyPath)
+	assert.Equal(t, testServiceTokenPublicKeyDirectory, cfg.InternalService.ServiceTokenSigning.PublicKeyDirectory)
+	assert.Equal(t, testBootstrapCredentialRef, cfg.InternalService.OutboundIdentities["documentation"].CredentialRef)
+	assert.Equal(t, "urn:onex:resource:documentation-api", cfg.InternalService.OutboundIdentities["documentation"].Audience)
+	assert.Equal(t, 600, cfg.InternalService.TokenTTLSeconds)
+	assert.True(t, cfg.IsProduction())
+	assert.False(t, cfg.IsDevelopment())
+}
+
+func TestLoadDatabaseCommandConfigDoesNotRequireRuntimeSecrets(t *testing.T) {
+	t.Chdir(t.TempDir())
+	t.Setenv("APP_ENV", "local")
+	t.Setenv("IDENTITY_PHONE_HASH_KEY", "")
+	t.Setenv("DATABASE_HOST", "127.0.0.1")
+	t.Setenv("DATABASE_PORT", "5432")
+	t.Setenv("DATABASE_USERNAME", "validator")
+	t.Setenv("DATABASE_NAME", "platform_validator")
+
+	cfg, err := LoadDatabaseCommandConfig()
+	require.NoError(t, err)
+	assert.Equal(t, "127.0.0.1", cfg.Database.Host)
+	assert.Equal(t, 5432, cfg.Database.Port)
+	assert.Equal(t, "validator", cfg.Database.Username)
+	assert.Equal(t, "platform_validator", cfg.Database.Name)
+}
+
+func TestLoadBootstrapCommandConfigDoesNotRequireRuntimeSecrets(t *testing.T) {
+	t.Chdir(t.TempDir())
+	t.Setenv("APP_ENV", "local")
+	t.Setenv("IDENTITY_PHONE_HASH_KEY", "")
+	t.Setenv("DATABASE_HOST", "127.0.0.1")
+	t.Setenv("DATABASE_PORT", "5432")
+	t.Setenv("DATABASE_USERNAME", "bootstrap")
+	t.Setenv("DATABASE_NAME", "platform_bootstrap")
+	t.Setenv("ENCRYPTION_KEY", "bootstrap-encryption-key")
+
+	cfg, err := LoadBootstrapCommandConfig()
+	require.NoError(t, err)
+	assert.Equal(t, "127.0.0.1", cfg.Database.Host)
+	assert.Equal(t, 5432, cfg.Database.Port)
+	assert.Equal(t, "bootstrap", cfg.Database.Username)
+	assert.Equal(t, "platform_bootstrap", cfg.Database.Name)
+	assert.Equal(t, "bootstrap-encryption-key", cfg.EncryptionKey)
+}
+
+// TestConfigLoadEnvMissingSecret 验证身份运行时缺少 OAuth state 专用密钥时返回错误。
+func TestConfigLoadEnvMissingSecret(t *testing.T) {
+	t.Chdir(t.TempDir())
+	t.Setenv("APP_ENV", "local")
+	t.Setenv("APP_NAME", "platform-api")
+	t.Setenv("IDENTITY_PHONE_HASH_KEY", testIdentityPhoneHashKey)
+	t.Setenv("IDENTITY_OAUTH_STATE_SIGNING_SECRET", "")
+	t.Setenv("IDENTITY_ACCESS_TOKEN_PRIVATE_KEY_PATH", "/run/secrets/identity-access-token-private.pem")
+
+	_, err := Load()
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "IDENTITY_OAUTH_STATE_SIGNING_SECRET")
+}
+
+func TestValidateAdminExperienceConfig(t *testing.T) {
+	valid := AdminExperienceConfig{ExternalProducts: []AdminExperienceExternalProductConfig{{
+		ProductCode: "product_alpha",
+		BaseURL:     "https://product_alpha.internal.example/admin-experience",
+		Datasets: []AdminExperienceExternalDatasetConfig{{
+			Key: "product_alpha.user.safety_summary", DescriptorHash: strings.Repeat("a", 64),
+		}},
+	}}}
+	require.NoError(t, validateAdminExperienceConfig(valid))
+
+	tests := []struct {
+		name   string
+		mutate func(*AdminExperienceConfig)
+	}{
+		{name: "duplicate product", mutate: func(cfg *AdminExperienceConfig) {
+			cfg.ExternalProducts = append(cfg.ExternalProducts, cfg.ExternalProducts[0])
+		}},
+		{name: "untrusted URL", mutate: func(cfg *AdminExperienceConfig) {
+			cfg.ExternalProducts[0].BaseURL = "https://user@example.com/path?secret=value"
+		}},
+		{name: "unnamespaced dataset", mutate: func(cfg *AdminExperienceConfig) {
+			cfg.ExternalProducts[0].Datasets[0].Key = "other.user.safety_summary"
+		}},
+		{name: "invalid hash", mutate: func(cfg *AdminExperienceConfig) {
+			cfg.ExternalProducts[0].Datasets[0].DescriptorHash = "not-a-hash"
+		}},
+		{name: "missing dataset", mutate: func(cfg *AdminExperienceConfig) {
+			cfg.ExternalProducts[0].Datasets = nil
+		}},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := valid
+			cfg.ExternalProducts = append([]AdminExperienceExternalProductConfig(nil), valid.ExternalProducts...)
+			cfg.ExternalProducts[0].Datasets = append(
+				[]AdminExperienceExternalDatasetConfig(nil), valid.ExternalProducts[0].Datasets...,
+			)
+			tc.mutate(&cfg)
+			require.Error(t, validateAdminExperienceConfig(cfg))
+		})
+	}
+}
+
+func validInternalServiceConfigForTest() InternalServiceConfig {
+	return InternalServiceConfig{
+		PlatformBaseURL:      "http://platform-api:3002/internal/v1",
+		DocumentationBaseURL: "http://documentation-api:3010/api/v1/documentation",
+		OutboundIdentities: map[string]InternalServiceIdentityConfig{
+			"platform": {
+				CredentialRef:              testBootstrapCredentialRef,
+				AllowedProductCodes:        []string{"product_alpha"},
+				Audience:                   "urn:onex:resource:platform-internal-api",
+				ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+			},
+		},
+		TokenTTLSeconds:                         defaultInternalServiceTokenTTLSeconds,
+		AuthorizationConsistencyTokenTTLSeconds: defaultIAMConsistencyTokenTTLSeconds,
+		RequestTimeout:                          10 * time.Second,
+	}
+}
+
+func validFeatureFlagConfigForTest() FeatureFlagConfig {
+	return FeatureFlagConfig{
+		FreshnessTTL:    30 * time.Second,
+		MaximumStaleAge: 15 * time.Minute,
+		CacheTTL:        30 * time.Minute,
+	}
+}
+
+func validIdentityRuntimeConfigForTest() IdentityConfig {
+	return IdentityConfig{
+		PhoneHashKey:            testIdentityPhoneHashKey,
+		OAuthStateSigningSecret: testIdentityOAuthStateSigningSecret,
+		Clients: map[string]IdentityClientConfig{
+			"product-alpha-web": {
+				ProductCode:                  "product_alpha",
+				ApplicationCode:              "consumer_web",
+				AllowedPrincipalTypes:        []string{"user", "guest"},
+				RegistrationSource:           "product_alpha_web",
+				TokenExchangeServiceAccounts: []string{"svc_product_alpha_bff_prod"},
+				TokenExchangeResources: []string{
+					"urn:onex:resource:platform-internal-api",
+					"urn:onex:resource:documentation-api",
+				},
+			},
+		},
+		GuestCapability: IdentityGuestCapabilityConfig{
+			SecretProviderFile: "/run/secrets/identity-guest-capability.json",
+			InitialKeyID:       "guest-capability-2026-07",
+			VerifierInstanceID: "platform-api-1",
+		},
+		AccessToken: IdentityAccessTokenConfig{
+			Issuer:             "https://identity.example.com",
+			SigningKeyID:       "identity-key-2026-07",
+			PrivateKeyPath:     "/run/secrets/identity-access-token-private.pem",
+			PublicKeyDirectory: "/run/secrets/identity-access-token-public",
+			ClockSkewLeeway:    defaultIdentityClockSkewLeeway,
+			DelegatedTokenTTL:  time.Duration(defaultDelegatedAccessTokenTTLSeconds) * time.Second,
+			ProtectedResources: map[string]IdentityProtectedResourceConfig{
+				"platform_internal_api": {
+					ResourceIdentifier: "https://api.example.com",
+					Audience:           serviceidentity.AudiencePlatformInternalAPI,
+					ResourceName:       "OneX Platform Internal API",
+				},
+				"documentation_api": {
+					ResourceIdentifier: "https://documentation-api.example.com",
+					Audience:           serviceidentity.AudienceDocumentationAPI,
+					ResourceName:       "OneX Documentation API",
+				},
+			},
+			Resources: map[string]IdentityAccessTokenResourceConfig{
+				"product_alpha": {
+					Audience:    "urn:onex:resource:product_alpha-api",
+					UserScopes:  []string{"email", "openid", "profile", "product_alpha.read", "product_alpha.write"},
+					GuestScopes: []string{"openid", "profile", "product_alpha.read"},
+				},
+			},
+		},
+	}
+}
+
+func validInternalServiceRuntimeConfigForTest() *Config {
+	internal := validInternalServiceConfigForTest()
+	identity := internal.OutboundIdentities["platform"]
+	identity.AllowedProductCodes = []string{"product_beta"}
+	identity.ExpectedServiceAccountCode = "svc_product_beta_bff_prod"
+	internal.OutboundIdentities["platform"] = identity
+	return &Config{
+		App:             AppConfig{Name: "sample-product-bff", Env: "docker", Port: 3004},
+		InternalService: internal,
+	}
+}
+
+func TestApplyInternalServiceOutboundIdentitiesEnvironment(t *testing.T) {
+	t.Setenv("ONEX_INTERNAL_SERVICE_OUTBOUND_IDENTITIES", `{
+		"platform": {
+			"credential_ref": "env://ONEX_PRODUCT_A_PLATFORM_CREDENTIAL",
+			"allowed_product_codes": ["product_alpha"],
+			"audience": "urn:onex:resource:platform-internal-api",
+			"expected_service_account_code": "svc_product_alpha_bff_prod"
+		},
+		"documentation": {
+			"credential_ref": "file:///run/secrets/product-alpha-documentation.credential",
+			"allowed_product_codes": ["product_alpha"],
+			"audience": "urn:onex:resource:documentation-api",
+			"expected_service_account_code": "svc_product_alpha_documentation_prod"
+		}
+	}`)
+	v := viper.New()
+	require.NoError(t, applyInternalServiceOutboundIdentitiesEnvironment(v))
+	var loaded struct {
+		InternalService InternalServiceConfig `mapstructure:"internal_service"`
+	}
+	require.NoError(t, v.Unmarshal(&loaded))
+	require.Equal(t, map[string]InternalServiceIdentityConfig{
+		"platform": {
+			CredentialRef:              "env://ONEX_PRODUCT_A_PLATFORM_CREDENTIAL",
+			AllowedProductCodes:        []string{"product_alpha"},
+			Audience:                   "urn:onex:resource:platform-internal-api",
+			ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+		},
+		"documentation": {
+			CredentialRef:              "file:///run/secrets/product-alpha-documentation.credential",
+			AllowedProductCodes:        []string{"product_alpha"},
+			Audience:                   "urn:onex:resource:documentation-api",
+			ExpectedServiceAccountCode: "svc_product_alpha_documentation_prod",
+		},
+	}, loaded.InternalService.OutboundIdentities)
+}
+
+func TestApplyIdentityProtectedResourcesEnvironment(t *testing.T) {
+	t.Setenv("ONEX_IDENTITY_PROTECTED_RESOURCES", `{
+		"platform_internal_api": {
+			"resource_identifier": "https://api.example.com",
+			"audience": "urn:onex:resource:platform-internal-api",
+			"resource_name": "OneX Platform Internal API"
+		}
+	}`)
+	v := viper.New()
+	require.NoError(t, applyJSONRegistryEnvironment[IdentityProtectedResourceConfig](v, "ONEX_IDENTITY_PROTECTED_RESOURCES", "identity.access_token.protected_resources"))
+	var loaded struct {
+		Identity IdentityConfig `mapstructure:"identity"`
+	}
+	require.NoError(t, v.Unmarshal(&loaded))
+	require.Equal(t, map[string]IdentityProtectedResourceConfig{
+		"platform_internal_api": {
+			ResourceIdentifier: "https://api.example.com",
+			Audience:           serviceidentity.AudiencePlatformInternalAPI,
+			ResourceName:       "OneX Platform Internal API",
+		},
+	}, loaded.Identity.AccessToken.ProtectedResources)
+}
+
+func TestApplyIdentityProtectedResourcesEnvironmentRejectsInvalidRegistry(t *testing.T) {
+	for _, raw := range []string{
+		`null`,
+		`{"platform_internal_api":{"resource_identifier":"https://api.example.com","audience":"urn:onex:resource:platform-internal-api","resource_name":"OneX Platform Internal API","unknown":true}}`,
+		`{} {}`,
+	} {
+		t.Run(raw, func(t *testing.T) {
+			t.Setenv("ONEX_IDENTITY_PROTECTED_RESOURCES", raw)
+			require.Error(t, applyJSONRegistryEnvironment[IdentityProtectedResourceConfig](viper.New(), "ONEX_IDENTITY_PROTECTED_RESOURCES", "identity.access_token.protected_resources"))
+		})
+	}
+}
+
+func TestIdentityClientsEnvironmentReplacesFileRegistry(t *testing.T) {
+	v := viper.New()
+	setDefaults(v)
+	v.SetConfigType("yaml")
+	require.NoError(t, v.ReadConfig(strings.NewReader("identity:\n  clients:\n    fixture-web:\n      product_code: fixture\n")))
+	t.Setenv("ONEX_IDENTITY_CLIENTS", `{"admin-web":{"product_code":"platform","application_code":"admin_web","allowed_principal_types":["user"],"registration_source":"admin"}}`)
+	require.NoError(t, applyJSONRegistryEnvironment[IdentityClientConfig](v, "ONEX_IDENTITY_CLIENTS", "identity.clients"))
+	var cfg Config
+	require.NoError(t, v.Unmarshal(&cfg))
+	require.Len(t, cfg.Identity.Clients, 1)
+	require.Equal(t, "admin_web", cfg.Identity.Clients["admin-web"].ApplicationCode)
+	require.Equal(t, []string{"user"}, cfg.Identity.Clients["admin-web"].AllowedPrincipalTypes)
+	for _, raw := range []string{"null", "[]", "{} {}", `{"admin-web":{"unknown":true}}`} {
+		t.Setenv("ONEX_IDENTITY_CLIENTS", raw)
+		require.Error(t, applyJSONRegistryEnvironment[IdentityClientConfig](viper.New(), "ONEX_IDENTITY_CLIENTS", "identity.clients"))
+	}
+}