docs: 交付文档、维护指引与端到端回归

补齐 README、开发计划、维护交接与 E2E 用例，执行最终验收。
2026-10-21 21:40:00 +08:00
1 parent 5be5ca3376
commit 308332eb94
@@ -0,0 +1,79 @@
+# Backend env for the e2e stack. scripts/stack.sh passes this file as ENV_FILE,
+# so the backend reads ONLY this — never a developer's backend/.env.
+# Every value here is a throwaway for local/CI test runs; nothing is a real secret.
+# NO_ENTERPRISE and the real DATABASE_URL are exported by stack.sh (they depend on
+# the edition and the local Postgres). This placeholder points nowhere, so a backend
+# started without stack.sh fails fast instead of falling back to the dev database.
+DATABASE_URL=postgresql+psycopg://set-by-stack-sh@127.0.0.1:1/chattermate_e2e
+
+ENVIRONMENT=test
+JWT_SECRET_KEY=e2e-jwt-secret-not-for-production
+CONVERSATION_SECRET_KEY=e2e-conversation-secret-not-for-production
+# Same fixed test-only key as backend/tests/conftest.py.
+ENCRYPTION_KEY=QmFTbXc5RWQ4czRfQWpqSnhqZjhraGtYSGFYaXZ4SkRNS2kxZFB1Y2NrMD0=
+
+FRONTEND_URL=http://127.0.0.1:15173
+BACKEND_URL=http://127.0.0.1:18000
+VITE_WIDGET_URL=http://127.0.0.1:18000
+# Dashboard + the fake customer site the widget is embedded on (see src/components/chat-widget.ts).
+CORS_ORIGINS=["http://127.0.0.1:15173","http://127.0.0.1:13000"]
+HELP_CENTER_PUBLIC_MODE=path
+
+# Redis off: no shared cors:origins cache, no dev Redis traffic.
+REDIS_ENABLED=false
+
+# All mail goes to the stack's Mailpit (scripts/stack.sh). No username means no
+# SMTP login, which is how Mailpit runs.
+SMTP_SERVER=127.0.0.1
+SMTP_PORT=11025
+SMTP_USERNAME=
+SMTP_PASSWORD=
+FROM_EMAIL=no-reply@e2e.example.com
+
+# No push notifications, no S3.
+FIREBASE_CREDENTIALS=/nonexistent/firebase-config.json
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+
+# Providers that ignore the org's base_url (e.g. the CHATTERMATE default model)
+# still land on the fake LLM through the openai SDK's env fallback.
+OPENAI_BASE_URL=http://127.0.0.1:14010/v1
+OPENAI_API_KEY=e2e-fake-key
+
+# Short enough that the "AI times out" journey runs quickly; src/support/timeouts.ts waits longer.
+AGENT_RUN_TIMEOUT=15
+TOKENIZERS_PARALLELISM=false
+
+# Third-party APIs → the recording fake (services/fake-externals). See
+# backend/app/core/external_urls.py; deployments never set these.
+TELEGRAM_API_BASE=http://127.0.0.1:14020/telegram
+META_GRAPH_BASE=http://127.0.0.1:14020/graph
+META_GRAPH_INSTAGRAM_BASE=http://127.0.0.1:14020/graph-instagram
+SLACK_API_BASE=http://127.0.0.1:14020/slack
+LINE_API_BASE=http://127.0.0.1:14020/line
+TWILIO_API_BASE=http://127.0.0.1:14020/twilio
+PLIVO_API_BASE=http://127.0.0.1:14020/plivo
+HUBSPOT_API_BASE=http://127.0.0.1:14020/hubspot
+PIPEDRIVE_OAUTH_BASE=http://127.0.0.1:14020/pipedrive-oauth
+# Pipedrive names each company's API host in its token response; the fake names itself.
+PIPEDRIVE_API_BASE=http://127.0.0.1:14020/pipedrive
+JIRA_AUTH_BASE=http://127.0.0.1:14020/jira-auth
+JIRA_API_BASE=http://127.0.0.1:14020/jira
+SHOPIFY_ADMIN_BASE=http://127.0.0.1:14020/shopify
+
+# Webhook signing secrets the channel drivers sign with (src/channels/*). Must match
+# env.channelSecrets in src/env.ts.
+META_APP_SECRET=e2e-meta-app-secret
+SLACK_SIGNING_SECRET=e2e-slack-signing-secret
+SLACK_CLIENT_ID=e2e-slack-client-id
+SLACK_CLIENT_SECRET=e2e-slack-client-secret
+HUBSPOT_CLIENT_ID=e2e-hubspot-client-id
+HUBSPOT_CLIENT_SECRET=e2e-hubspot-client-secret
+PIPEDRIVE_CLIENT_ID=e2e-pipedrive-client-id
+PIPEDRIVE_CLIENT_SECRET=e2e-pipedrive-client-secret
+JIRA_CLIENT_ID=e2e-jira-client-id
+JIRA_CLIENT_SECRET=e2e-jira-client-secret
+JIRA_REDIRECT_URI=http://127.0.0.1:18000/api/v1/jira/callback
+# Shopify signs the embedded app's session tokens with the app secret (src/api/shopify.ts).
+SHOPIFY_API_KEY=e2e-shopify-api-key
+SHOPIFY_API_SECRET=e2e-shopify-api-secret