feat(FEAT-MO-001): 增加TDX直连配置与客户端

server/libs/config/src/runtime-config.test.ts

@@ -50,6 +50,8 @@ describe('进程级运行配置', () => {
       LOG_LEVEL: 'debug',
       API_HOST: '127.0.0.1',
       API_PORT: '3000',
+      TDX_BASE_URL: 'http://127.0.0.1:17710',
+      TDX_TIMEOUT_MS: '5000',
       ...baseRedisEnv,
       ...disabledMysqlEnv,
       ...disabledAiEnv,
@@ -129,6 +131,8 @@ describe('进程级运行配置', () => {
       LOG_LEVEL: 'debug',
       API_HOST: '127.0.0.1',
       API_PORT: '3000',
+      TDX_BASE_URL: 'http://127.0.0.1:17710',
+      TDX_TIMEOUT_MS: '5000',
       ...baseRedisEnv,
       ...enabledMysql,
       ...disabledAiEnv,
@@ -138,12 +142,38 @@ describe('进程级运行配置', () => {
     expect(() => loadApiConfig({ ...apiEnv, MYSQL_TIMEZONE: 'SYSTEM' })).toThrow(/MYSQL_TIMEZONE/);
   });
 
+  it('TDX 只允许本机回环地址和固定端口', () => {
+    const apiEnv = {
+      APP_ENV: 'development',
+      LOG_LEVEL: 'debug',
+      API_HOST: '127.0.0.1',
+      API_PORT: '3000',
+      TDX_BASE_URL: 'http://127.0.0.1:17710',
+      TDX_TIMEOUT_MS: '5000',
+      ...baseRedisEnv,
+      ...disabledMysqlEnv,
+      ...disabledAiEnv,
+    };
+
+    expect(() => loadApiConfig({ ...apiEnv, TDX_BASE_URL: 'http://192.168.28.106:17709' })).toThrow(
+      /TDX_BASE_URL 必须指向本机回环地址/,
+    );
+    expect(() => loadApiConfig({ ...apiEnv, TDX_BASE_URL: 'https://127.0.0.1:17710' })).toThrow(
+      /TDX_BASE_URL 必须使用 http 协议/,
+    );
+    expect(() => loadApiConfig({ ...apiEnv, TDX_BASE_URL: 'http://127.0.0.1:17711' })).toThrow(
+      /TDX_BASE_URL 必须使用 17710 端口/,
+    );
+  });
+
   it('日志摘要不包含任何连接密码、密钥或未知字段', () => {
     const config = loadApiConfig({
       APP_ENV: 'development',
       LOG_LEVEL: 'debug',
       API_HOST: '127.0.0.1',
       API_PORT: '3000',
+      TDX_BASE_URL: 'http://127.0.0.1:17710',
+      TDX_TIMEOUT_MS: '5000',
       ...baseRedisEnv,
       ...disabledMysqlEnv,
       ...disabledAiEnv,

server/libs/config/src/runtime-config.ts

@@ -35,6 +35,12 @@ export interface AiRuntimeConfig {
   timeoutMs: number;
 }
 
+/** API 只允许通过本机 SSH/Tailscale 隧道访问 TDX，禁止把家庭地址暴露给业务请求。 */
+export interface TdxRuntimeConfig {
+  baseUrl: string;
+  timeoutMs: number;
+}
+
 /** RocketMQ 公共寻址配置；实际生产/消费参数由相应进程扩展。 */
 export interface RocketMqRuntimeConfig {
   enabled: boolean;
@@ -54,6 +60,7 @@ interface CommonRuntimeConfig {
 export interface ApiRuntimeConfig extends CommonRuntimeConfig {
   processName: 'api';
   api: Readonly<{ host: string; port: number }>;
+  tdx: Readonly<TdxRuntimeConfig>;
   mysql: MysqlRuntimeConfig;
   ai: AiRuntimeConfig;
 }
@@ -196,6 +203,30 @@ function loadAiConfig(env: EnvironmentSource): AiRuntimeConfig {
   };
 }
 
+function loadTdxConfig(env: EnvironmentSource): TdxRuntimeConfig {
+  const baseUrl = requireText(env, 'TDX_BASE_URL').replace(/\/$/, '');
+  let parsed: URL;
+  try {
+    parsed = new URL(baseUrl);
+  } catch {
+    throw new Error('TDX_BASE_URL 必须为有效 URL');
+  }
+
+  if (parsed.protocol !== 'http:') throw new Error('TDX_BASE_URL 必须使用 http 协议');
+  if (parsed.hostname !== '127.0.0.1') {
+    throw new Error('TDX_BASE_URL 必须指向本机回环地址');
+  }
+  if (parsed.port !== '17710') throw new Error('TDX_BASE_URL 必须使用 17710 端口');
+  if (parsed.pathname !== '' && parsed.pathname !== '/') {
+    throw new Error('TDX_BASE_URL 不得包含额外路径');
+  }
+
+  return {
+    baseUrl: parsed.toString().replace(/\/$/, ''),
+    timeoutMs: parseInteger(env, 'TDX_TIMEOUT_MS', { min: 100, max: 30_000 }),
+  };
+}
+
 function loadRocketMqConfig(env: EnvironmentSource): RocketMqRuntimeConfig {
   const enabled = parseBoolean(env, 'ROCKETMQ_ENABLED');
   const nameServerAddress = optionalText(env, 'ROCKETMQ_NAMESRV_ADDR');
@@ -225,6 +256,7 @@ export function loadApiConfig(env: EnvironmentSource): ApiRuntimeConfig {
       host: requireText(env, 'API_HOST'),
       port: parseInteger(env, 'API_PORT', { min: 1, max: 65_535 }),
     },
+    tdx: loadTdxConfig(env),
     redis: loadRedisConfig(env),
     mysql: loadMysqlConfig(env),
     ai: loadAiConfig(env),