create-skweb 3.1.0 → 3.2.0

package/templates/cjs/src/utils/config.auth-jwks.js

@@ -0,0 +1,67 @@
+const { logger } = require('./logger.js')
+
+function validateConfig() {
+  const errors = []
+
+  if (!process.env.DB_HOST) {
+    logger.warn('[config] DB_HOST not set, using default: 127.0.0.1')
+  }
+  if (!process.env.DB_NAME) {
+    logger.warn('[config] DB_NAME not set, using default: test-project')
+  }
+  if (!process.env.DB_USER) {
+    logger.warn('[config] DB_USER not set, using default: root')
+  }
+
+  if (!process.env.REDIS_HOST) {
+    logger.warn('[config] REDIS_HOST not set, using default: 127.0.0.1')
+  }
+
+  const port = Number(process.env.PORT)
+  if (port && (port < 1 || port > 65535)) {
+    errors.push('PORT must be between 1 and 65535')
+  }
+
+  const dbPort = Number(process.env.DB_PORT)
+  if (dbPort && (dbPort < 1 || dbPort > 65535)) {
+    errors.push('DB_PORT must be between 1 and 65535')
+  }
+
+  const redisPort = Number(process.env.REDIS_PORT)
+  if (redisPort && (redisPort < 1 || redisPort > 65535)) {
+    errors.push('REDIS_PORT must be between 1 and 65535')
+  }
+
+  return {
+    isValid: errors.length === 0,
+    errors
+  }
+}
+
+function checkOIDCConfig() {
+  const issuer = process.env.OIDC_ISSUER
+  const jwksUri = process.env.OIDC_JWKS_URI
+  if (!issuer && !jwksUri) {
+    logger.error('[config] OIDC_ISSUER or OIDC_JWKS_URI must be set for jwks auth')
+    return false
+  }
+  if (process.env.NODE_ENV === 'production' && !process.env.OIDC_AUDIENCE) {
+    logger.warn('[config] OIDC_AUDIENCE is not set; audience verification will be skipped')
+  }
+  return true
+}
+
+function checkRequiredEnv() {
+  const result = validateConfig()
+
+  if (result.errors.length > 0) {
+    logger.error('[config] Configuration validation failed:')
+    result.errors.forEach((err) => logger.error(`  - ${err}`))
+    return false
+  }
+
+  logger.info('[config] Configuration validation passed')
+  return true
+}
+
+module.exports = { validateConfig, checkOIDCConfig, checkRequiredEnv }

package/templates/cjs/src/utils/{config.js → config.auth-static.js}

@@ -13,10 +13,6 @@ function validateConfig() {
     logger.warn('[config] DB_USER not set, using default: root')
   }
 
-  if (process.env.JWT_SECRET === 'please-change-this-in-production') {
-    logger.warn('[config] WARNING: JWT_SECRET is using default value, please change in production!')
-  }
-
   if (!process.env.REDIS_HOST) {
     logger.warn('[config] REDIS_HOST not set, using default: 127.0.0.1')
   }
@@ -42,24 +38,28 @@ function validateConfig() {
   }
 }
 
+function checkJwtSecret() {
+  if (process.env.JWT_SECRET === 'please-change-this-in-production' || !process.env.JWT_SECRET) {
+    if (process.env.NODE_ENV === 'production') {
+      logger.error('[config] JWT_SECRET must be set in production!')
+      return false
+    }
+    logger.warn('[config] WARNING: JWT_SECRET is using default value, please change in production!')
+  }
+  return true
+}
+
 function checkRequiredEnv() {
   const result = validateConfig()
-  
+
   if (result.errors.length > 0) {
     logger.error('[config] Configuration validation failed:')
     result.errors.forEach((err) => logger.error(`  - ${err}`))
     return false
   }
 
-  if (process.env.NODE_ENV === 'production') {
-    if (!process.env.JWT_SECRET || process.env.JWT_SECRET === 'please-change-this-in-production') {
-      logger.error('[config] JWT_SECRET must be set in production!')
-      return false
-    }
-  }
-
   logger.info('[config] Configuration validation passed')
   return true
 }
 
-module.exports = { validateConfig, checkRequiredEnv }
+module.exports = { validateConfig, checkJwtSecret, checkRequiredEnv }

package/templates/mjs/{.env.example → .env.example.auth-jwks}

@@ -38,23 +38,12 @@ REDIS_DB=0
 # (Production is always disabled to avoid exposing internal API details.)
 SWAGGER_ENABLED=true
 
-# ---------- Auth Provider ----------
-# 'static' (default): use a shared secret (HS256)
-# 'jwks': verify via JWKS endpoint (Keycloak / Auth0 / generic OIDC)
-AUTH_PROVIDER={{auth}}
-
-# ---------- JWT (static mode) ----------
-# [REQUIRED in production] Use a strong random string, e.g. `openssl rand -hex 32`
-JWT_SECRET=please-change-this-in-production
-JWT_EXPIRES_IN=7d
-
-# ---------- JWT (jwks mode, OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
 #   Okta:      https://your-domain.okta.com/oauth2/default
 #   Authing:   https://your-app.authing.cn/oauth2/default
-#   Keycloak Realm: https://kc.example.com/auth/realms/myrealm
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.

package/templates/mjs/.env.example.auth-static

@@ -0,0 +1,54 @@
+# ============================================
+# SKWeb Environment Variables Template
+# ============================================
+# Copy this file to .env and fill in your values:
+#   cp .env.example .env
+#
+# Variables with default values can be omitted.
+# Variables marked [REQUIRED] must be set in production.
+
+# ---------- Node Environment ----------
+# Development | Production | Test
+NODE_ENV=development
+
+# ---------- Server ----------
+PORT=3000
+HOST=0.0.0.0
+
+# ---------- Database (MySQL / MariaDB) ----------
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_USER=root
+DB_PASS=
+DB_NAME={{name}}
+DB_DIALECT=mysql
+DB_CHARSET=utf8mb4
+DEBUG_DB=false
+
+# ---------- Redis ----------
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_PASSWORD=
+REDIS_DB=0
+
+# ---------- Swagger / OpenAPI ----------
+# Mounts Swagger UI at /api-docs and exposes raw spec at /api-docs.json.
+# Only enabled when NODE_ENV is 'development' or 'test'.
+# Set SWAGGER_ENABLED=false to force-disable in dev/test as well.
+# (Production is always disabled to avoid exposing internal API details.)
+SWAGGER_ENABLED=true
+
+# ---------- Auth: static (HS256 shared secret) ----------
+# [REQUIRED in production] Use a strong random string, e.g. `openssl rand -hex 32`
+JWT_SECRET=please-change-this-in-production
+JWT_EXPIRES_IN=7d
+
+# ---------- Logging ----------
+# error | warn | info | http | verbose | debug | silly
+LOG_LEVEL=info
+LOG_DIR=./logs
+LOG_CONSOLE=true
+
+# ---------- CORS ----------
+# Comma-separated origins, or * for all
+CORS_ORIGIN=*

package/templates/mjs/package.json

@@ -22,14 +22,14 @@
   "dependencies": {
     "@dotenvx/dotenvx": "^1.75.1",
     "http-errors": "^2.0.1",
-    "skweb-express": "^2.0.0",
+    "skweb-express": "^2.0.3",
     "skweb-express-jwt": "^3.0.0",
     "skweb-express-logger": "^2.0.0",
     "skweb-sequelize": "^2.0.0",
     "skweb-redis": "^2.0.0",
     "skweb-cron": "^2.0.0",
-    "skweb-framework": "^2.0.0",
-    "skweb-plugin": "^2.0.0",
+    "skweb-framework": "^2.1.0",
+    "skweb-plugin": "^2.1.1",
     "skweb-util": "^2.0.0",
     "winston": "^3.19.0",
     "sequelize": "^6.37.8",

package/templates/mjs/src/app.auth-jwks.js

@@ -0,0 +1,137 @@
+import 'dotenv/config'
+
+import path from 'path'
+import { fileURLToPath } from 'url'
+import express from 'skweb-express'
+import expressLogger, { errorHandler as expressErrorHandler } from 'skweb-express-logger'
+import swaggerUi from 'swagger-ui-express'
+import logger from './utils/logger.js'
+import { checkRequiredEnv, checkOIDCConfig } from './utils/config.js'
+import { buildOpenApiSpec } from './swagger.js'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+
+/**
+ * JWT 配置（jwks 模式，通过 OIDC 兼容的 JWKS 端点验证 RS256 签名）。
+ */
+function buildJwtOptions() {
+  const issuer = process.env.OIDC_ISSUER
+  const jwksUri = process.env.OIDC_JWKS_URI
+  const audience = process.env.OIDC_AUDIENCE
+  if (!issuer && !jwksUri) {
+    throw new Error('jwks mode requires OIDC_ISSUER or OIDC_JWKS_URI')
+  }
+  return {
+    provider: 'jwks',
+    algorithms: ['RS256'],
+    jwks: { jwksUri, issuer, audience },
+    verify: { issuer, audience },
+    requestProperty: 'resolvedToken'
+  }
+}
+
+function shouldEnableSwagger() {
+  const env = (process.env.NODE_ENV || '').toLowerCase()
+  if (env !== 'development' && env !== 'test') return false
+  if ((process.env.SWAGGER_ENABLED || '').toLowerCase() === 'false') return false
+  return true
+}
+
+async function bootstrap() {
+  logger.info('[app] Initializing web process...')
+
+  if (!checkRequiredEnv()) {
+    logger.error('[app] Configuration validation failed, exiting...')
+    process.exit(1)
+  }
+  if (!checkOIDCConfig()) {
+    logger.error('[app] OIDC configuration validation failed, exiting...')
+    process.exit(1)
+  }
+
+  const { WebFramework } = await import('skweb-framework')
+
+  const framework = new WebFramework({
+    db: {
+      host: process.env.DB_HOST || '127.0.0.1',
+      port: Number(process.env.DB_PORT) || 3306,
+      username: process.env.DB_USER || 'root',
+      password: process.env.DB_PASS || '',
+      database: process.env.DB_NAME || 'test-project',
+      dialect: process.env.DB_DIALECT || 'mysql',
+      charset: process.env.DB_CHARSET || 'utf8mb4',
+      underscored: true,
+      logging: process.env.DEBUG_DB === 'true' ? (msg) => logger.debug(msg) : false
+    },
+    redis: {
+      host: process.env.REDIS_HOST || '127.0.0.1',
+      port: Number(process.env.REDIS_PORT) || 6379,
+      password: process.env.REDIS_PASSWORD || undefined
+    }
+  })
+
+  const app = framework.createApp()
+
+  await framework.setup({
+    modelsDir: path.join(__dirname, './models'),
+    controllersDir: path.join(__dirname, './controllers')
+  })
+
+  app.disable('x-powered-by')
+  app.disable('etag')
+
+  app.set('trust proxy', true)
+
+  app.set('wrap response', true)
+  app.setOkCode(0)
+  app.setOkMessage('success')
+
+  const jwtOptions = buildJwtOptions()
+  app.setJWT('default', jwtOptions)
+  app.setJwtHintHeader('JwtHint')
+
+  logger.info(`[app] JWT auth provider: jwks (issuer: ${jwtOptions.jwks.issuer || jwtOptions.jwks.jwksUri})`)
+
+  app.use(expressLogger())
+  app.use(express.static(path.join(__dirname, '..', 'public')))
+
+  if (shouldEnableSwagger()) {
+    const openapiSpec = buildOpenApiSpec()
+    app.get('/api-docs.json', (_req, res) => res.json(openapiSpec))
+    app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(openapiSpec, {
+      customSiteTitle: `${process.env.APP_NAME || 'SKWeb'} API Docs`,
+      swaggerOptions: { persistAuthorization: true }
+    }))
+    logger.info(`[app] Swagger UI mounted at http://localhost:${process.env.PORT || 3000}/api-docs (env: ${process.env.NODE_ENV})`)
+  } else {
+    logger.info(`[app] Swagger UI disabled (env: ${process.env.NODE_ENV || 'unset'})`)
+  }
+
+  await framework.loadControllers()
+
+  app.use(expressErrorHandler())
+
+  framework.start(Number(process.env.PORT) || 3000)
+
+  logger.info('[app] Initialization complete (web process)')
+
+  process.on('uncaughtException', (err) => {
+    logger.error(`[app] uncaughtException: ${err.stack || err.message}`)
+    process.exit(1)
+  })
+  process.on('unhandledRejection', (reason) => {
+    logger.error(`[app] unhandledRejection: ${reason instanceof Error ? reason.stack : String(reason)}`)
+    process.exit(1)
+  })
+}
+
+const isMainModule = import.meta.url === `file://${process.argv[1]}`
+if (isMainModule) {
+  bootstrap().catch((err) => {
+    logger.error('[app] Fatal error:', err)
+    process.exit(1)
+  })
+}
+
+export { bootstrap }

package/templates/mjs/src/{app.js → app.auth-static.js}

@@ -6,36 +6,16 @@ import express from 'skweb-express'
 import expressLogger, { errorHandler as expressErrorHandler } from 'skweb-express-logger'
 import swaggerUi from 'swagger-ui-express'
 import logger from './utils/logger.js'
-import { checkRequiredEnv } from './utils/config.js'
+import { checkRequiredEnv, checkJwtSecret } from './utils/config.js'
 import { buildOpenApiSpec } from './swagger.js'
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
 
 /**
- * 构建 JWT 配置，支持两种模式：
- *  - 'static' (默认)：使用共享密钥（HS256/HS384/HS512），适用于自签 token
- *  - 'jwks'：通过 JWKS 端点动态获取公钥（RS256 等），适用于 Keycloak/Auth0 等 IdP
+ * JWT 配置（static 模式，HS256 共享密钥）。
  */
 function buildJwtOptions() {
-  const provider = process.env.AUTH_PROVIDER || 'static'
-
-  if (provider === 'jwks') {
-    const issuer = process.env.OIDC_ISSUER
-    const jwksUri = process.env.OIDC_JWKS_URI
-    const audience = process.env.OIDC_AUDIENCE
-    if (!issuer && !jwksUri) {
-      throw new Error('AUTH_PROVIDER=jwks requires OIDC_ISSUER or OIDC_JWKS_URI')
-    }
-    return {
-      provider: 'jwks',
-      algorithms: ['RS256'],
-      jwks: { jwksUri, issuer, audience },
-      verify: { issuer, audience },
-      requestProperty: 'resolvedToken'
-    }
-  }
-
   return {
     provider: 'static',
     secret: process.env.JWT_SECRET || 'please-change-this-in-production',
@@ -45,10 +25,6 @@ function buildJwtOptions() {
   }
 }
 
-/**
- * Swagger UI 仅在 NODE_ENV 为 development / test，且 SWAGGER_ENABLED !== 'false' 时启用。
- * 生产环境（production / unset）默认禁用，避免暴露内部 API 细节。
- */
 function shouldEnableSwagger() {
   const env = (process.env.NODE_ENV || '').toLowerCase()
   if (env !== 'development' && env !== 'test') return false
@@ -63,6 +39,10 @@ async function bootstrap() {
     logger.error('[app] Configuration validation failed, exiting...')
     process.exit(1)
   }
+  if (!checkJwtSecret()) {
+    logger.error('[app] JWT configuration validation failed, exiting...')
+    process.exit(1)
+  }
 
   const { WebFramework } = await import('skweb-framework')
 
@@ -101,21 +81,15 @@ async function bootstrap() {
   app.setOkCode(0)
   app.setOkMessage('success')
 
-  // JWT 配置（按 AUTH_PROVIDER 选择 static 或 jwks 模式）
   const jwtOptions = buildJwtOptions()
   app.setJWT('default', jwtOptions)
   app.setJwtHintHeader('JwtHint')
 
-  if (jwtOptions.provider === 'jwks') {
-    logger.info(`[app] JWT auth provider: jwks (issuer: ${jwtOptions.jwks.issuer || jwtOptions.jwks.jwksUri})`)
-  } else {
-    logger.info('[app] JWT auth provider: static (HS256)')
-  }
+  logger.info('[app] JWT auth provider: static (HS256)')
 
   app.use(expressLogger())
   app.use(express.static(path.join(__dirname, '..', 'public')))
 
-  // 仅在 dev / test 环境挂载 Swagger UI（默认关闭，需显式 SWAGGER_ENABLED=true）
   if (shouldEnableSwagger()) {
     const openapiSpec = buildOpenApiSpec()
     app.get('/api-docs.json', (_req, res) => res.json(openapiSpec))
@@ -130,14 +104,12 @@ async function bootstrap() {
 
   await framework.loadControllers()
 
-  // 错误日志中间件：挂在所有路由之后，记录业务错误并继续传递给默认错误处理。
   app.use(expressErrorHandler())
 
   framework.start(Number(process.env.PORT) || 3000)
 
   logger.info('[app] Initialization complete (web process)')
 
-  // 未捕获异常：打印堆栈后直接退出。OS / 进程管理器负责回收资源。
   process.on('uncaughtException', (err) => {
     logger.error(`[app] uncaughtException: ${err.stack || err.message}`)
     process.exit(1)

package/templates/mjs/src/swagger.auth-jwks.js

@@ -0,0 +1,38 @@
+import path from 'path'
+import { fileURLToPath } from 'url'
+import swaggerJSDoc from 'swagger-jsdoc'
+
+const __filename = fileURLToPath(import.meta.url)
+const __dirname = path.dirname(__filename)
+
+export function buildOpenApiSpec() {
+  return swaggerJSDoc({
+    definition: {
+      openapi: '3.0.3',
+      info: {
+        title: process.env.APP_NAME || 'SKWeb API',
+        version: process.env.API_VERSION || '1.0.0',
+        description: process.env.APP_DESCRIPTION || 'SKWeb project API documentation',
+        contact: { name: 'API Support' }
+      },
+      servers: [
+        { url: `http://localhost:${process.env.PORT || 3000}`, description: 'Local development' }
+      ],
+      components: {
+        securitySchemes: {
+          oidcAuth: {
+            type: 'openIdConnect',
+            openIdConnectUrl: process.env.OIDC_JWKS_URI
+              ? process.env.OIDC_JWKS_URI.replace(/\/jwks\.json$/, '/.well-known/openid-configuration')
+              : (process.env.OIDC_ISSUER
+                  ? `${process.env.OIDC_ISSUER.replace(/\/$/, '')}/.well-known/openid-configuration`
+                  : undefined)
+          }
+        }
+      }
+    },
+    apis: [
+      path.join(__dirname, 'controllers', '*.js')
+    ]
+  })
+}

package/templates/mjs/src/{swagger.js → swagger.auth-static.js}

@@ -5,22 +5,6 @@ import swaggerJSDoc from 'swagger-jsdoc'
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
 
-/**
- * 构建 OpenAPI 3.0 规范对象。
- *
- * 控制器中应使用 @swagger JSDoc 注释描述端点，例如：
- *
- *   /**
- *    * @swagger
- *    * /api/users:
- *    *   get:
- *    *     summary: 获取用户列表
- *    *     tags: [Users]
- *    *     responses:
- *    *       200:
- *    *         description: OK
- *    *\/
- */
 export function buildOpenApiSpec() {
   return swaggerJSDoc({
     definition: {
@@ -39,8 +23,7 @@ export function buildOpenApiSpec() {
           bearerAuth: {
             type: 'http',
             scheme: 'bearer',
-            bearerFormat: 'JWT',
-            description: 'Paste a JWT token here (only needed when AUTH_PROVIDER=static)'
+            bearerFormat: 'JWT'
           }
         }
       }

package/templates/mjs/src/utils/config.auth-jwks.js

@@ -0,0 +1,65 @@
+import logger from './logger.js'
+
+export function validateConfig() {
+  const errors = []
+
+  if (!process.env.DB_HOST) {
+    logger.warn('[config] DB_HOST not set, using default: 127.0.0.1')
+  }
+  if (!process.env.DB_NAME) {
+    logger.warn('[config] DB_NAME not set, using default: test-project')
+  }
+  if (!process.env.DB_USER) {
+    logger.warn('[config] DB_USER not set, using default: root')
+  }
+
+  if (!process.env.REDIS_HOST) {
+    logger.warn('[config] REDIS_HOST not set, using default: 127.0.0.1')
+  }
+
+  const port = Number(process.env.PORT)
+  if (port && (port < 1 || port > 65535)) {
+    errors.push('PORT must be between 1 and 65535')
+  }
+
+  const dbPort = Number(process.env.DB_PORT)
+  if (dbPort && (dbPort < 1 || dbPort > 65535)) {
+    errors.push('DB_PORT must be between 1 and 65535')
+  }
+
+  const redisPort = Number(process.env.REDIS_PORT)
+  if (redisPort && (redisPort < 1 || redisPort > 65535)) {
+    errors.push('REDIS_PORT must be between 1 and 65535')
+  }
+
+  return {
+    isValid: errors.length === 0,
+    errors
+  }
+}
+
+export function checkOIDCConfig() {
+  const issuer = process.env.OIDC_ISSUER
+  const jwksUri = process.env.OIDC_JWKS_URI
+  if (!issuer && !jwksUri) {
+    logger.error('[config] OIDC_ISSUER or OIDC_JWKS_URI must be set for jwks auth')
+    return false
+  }
+  if (process.env.NODE_ENV === 'production' && !process.env.OIDC_AUDIENCE) {
+    logger.warn('[config] OIDC_AUDIENCE is not set; audience verification will be skipped')
+  }
+  return true
+}
+
+export function checkRequiredEnv() {
+  const result = validateConfig()
+
+  if (result.errors.length > 0) {
+    logger.error('[config] Configuration validation failed:')
+    result.errors.forEach((err) => logger.error(`  - ${err}`))
+    return false
+  }
+
+  logger.info('[config] Configuration validation passed')
+  return true
+}

package/templates/mjs/src/utils/{config.js → config.auth-static.js}

@@ -13,10 +13,6 @@ export function validateConfig() {
     logger.warn('[config] DB_USER not set, using default: root')
   }
 
-  if (process.env.JWT_SECRET === 'please-change-this-in-production') {
-    logger.warn('[config] WARNING: JWT_SECRET is using default value, please change in production!')
-  }
-
   if (!process.env.REDIS_HOST) {
     logger.warn('[config] REDIS_HOST not set, using default: 127.0.0.1')
   }
@@ -42,22 +38,26 @@ export function validateConfig() {
   }
 }
 
+export function checkJwtSecret() {
+  if (process.env.JWT_SECRET === 'please-change-this-in-production' || !process.env.JWT_SECRET) {
+    if (process.env.NODE_ENV === 'production') {
+      logger.error('[config] JWT_SECRET must be set in production!')
+      return false
+    }
+    logger.warn('[config] WARNING: JWT_SECRET is using default value, please change in production!')
+  }
+  return true
+}
+
 export function checkRequiredEnv() {
   const result = validateConfig()
-  
+
   if (result.errors.length > 0) {
     logger.error('[config] Configuration validation failed:')
     result.errors.forEach((err) => logger.error(`  - ${err}`))
     return false
   }
 
-  if (process.env.NODE_ENV === 'production') {
-    if (!process.env.JWT_SECRET || process.env.JWT_SECRET === 'please-change-this-in-production') {
-      logger.error('[config] JWT_SECRET must be set in production!')
-      return false
-    }
-  }
-
   logger.info('[config] Configuration validation passed')
   return true
-}
+}

package/templates/ts/{.env.example → .env.example.auth-jwks}

@@ -38,23 +38,12 @@ REDIS_DB=0
 # (Production is always disabled to avoid exposing internal API details.)
 SWAGGER_ENABLED=true
 
-# ---------- Auth Provider ----------
-# 'static' (default): use a shared secret (HS256)
-# 'jwks': verify via JWKS endpoint (Keycloak / Auth0 / generic OIDC)
-AUTH_PROVIDER={{auth}}
-
-# ---------- JWT (static mode) ----------
-# [REQUIRED in production] Use a strong random string, e.g. `openssl rand -hex 32`
-JWT_SECRET=please-change-this-in-production
-JWT_EXPIRES_IN=7d
-
-# ---------- JWT (jwks mode, OIDC compatible) ----------
+# ---------- Auth: jwks (OIDC compatible) ----------
 # Works with any OIDC-compliant IdP. Common issuer formats:
 #   Keycloak:  https://kc.example.com/realms/myrealm
 #   Auth0:     https://your-tenant.auth0.com/
 #   Okta:      https://your-domain.okta.com/oauth2/default
 #   Authing:   https://your-app.authing.cn/oauth2/default
-#   Keycloak Realm: https://kc.example.com/auth/realms/myrealm
 # `audience` is the client id of this API in the IdP (recommended).
 # JWKS URI is auto-derived as ${OIDC_ISSUER}/.well-known/jwks.json
 # unless OIDC_JWKS_URI is set explicitly.