feat(t230): use OCR for ERP session login

backend-api/internal/config/config.go

@@ -22,6 +22,7 @@ const (
 	ShunyunbaoURLEnvironment      = "CMROUBAO_SHUNYUNBAO_URL"
 	ShunyunbaoUsernameEnvironment = "CMROUBAO_SHUNYUNBAO_USERNAME"
 	ShunyunbaoPasswordEnvironment = "CMROUBAO_SHUNYUNBAO_PASSWORD"
+	OCRAPIURLEnvironment          = "CMROUBAO_OCR_API_URL"
 
 	defaultHTTPAddress    = "127.0.0.1:8080"
 	defaultDatabasePath   = "var/cmroubao.db"
@@ -52,6 +53,7 @@ type Config struct {
 	ShunyunbaoURL      string
 	ShunyunbaoUsername string
 	ShunyunbaoPassword string
+	OCRAPIURL          string
 	ShunyunbaoTimeout  time.Duration
 }
 
@@ -177,6 +179,13 @@ func Load(lookup LookupEnvironment) (Config, error) {
 				ShunyunbaoPasswordEnvironment + " must be set together",
 		)
 	}
+	ocrAPIURL, ocrAPISet, err := optionalEnvironmentValue(lookup, OCRAPIURLEnvironment)
+	if err != nil {
+		return Config{}, err
+	}
+	if ocrAPISet && !validOCRAPIURL(ocrAPIURL) {
+		return Config{}, errors.New(OCRAPIURLEnvironment + " must be an approved OCR endpoint")
+	}
 
 	return Config{
 		HTTPAddress:        httpAddress,
@@ -196,10 +205,34 @@ func Load(lookup LookupEnvironment) (Config, error) {
 		ShunyunbaoURL:      strings.TrimRight(shunyunbaoURL, "/"),
 		ShunyunbaoUsername: shunyunbaoUsername,
 		ShunyunbaoPassword: shunyunbaoPassword,
+		OCRAPIURL:          ocrAPIURL,
 		ShunyunbaoTimeout:  30 * time.Second,
 	}, nil
 }
 
+func validOCRAPIURL(value string) bool {
+	parsed, err := url.Parse(value)
+	if err != nil || parsed.Host == "" || parsed.User != nil ||
+		parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Path == "" {
+		return false
+	}
+	if port := parsed.Port(); port != "" {
+		parsedPort, portErr := strconv.Atoi(port)
+		if portErr != nil || parsedPort < 1 || parsedPort > 65535 {
+			return false
+		}
+	}
+	if parsed.Scheme == "https" {
+		return true
+	}
+	if parsed.Scheme != "http" {
+		return false
+	}
+	host := strings.Trim(parsed.Hostname(), "[]")
+	return strings.EqualFold(host, "localhost") ||
+		(net.ParseIP(host) != nil && net.ParseIP(host).IsLoopback())
+}
+
 func validateHTTPSOrigin(value, environment string) error {
 	parsed, err := url.Parse(value)
 	if err != nil || parsed.Scheme != "https" || parsed.Host == "" ||

backend-api/internal/config/envfile.go

@@ -122,7 +122,8 @@ func isERPEnvironmentName(name string) bool {
 	switch name {
 	case ShunyunbaoURLEnvironment,
 		ShunyunbaoUsernameEnvironment,
-		ShunyunbaoPasswordEnvironment:
+		ShunyunbaoPasswordEnvironment,
+		OCRAPIURLEnvironment:
 		return true
 	default:
 		return false

backend-api/internal/config/envfile_test.go

@@ -13,6 +13,7 @@ func TestWithERPEnvironmentFileUsesApprovedFallbackValues(t *testing.T) {
 		"CMROUBAO_SHUNYUNBAO_URL=https://erp.example.test",
 		"CMROUBAO_SHUNYUNBAO_USERNAME=dotenv-user",
 		"CMROUBAO_SHUNYUNBAO_PASSWORD='dotenv password #1'",
+		"CMROUBAO_OCR_API_URL=http://127.0.0.1:8000/ocr",
 	}, "\n"))
 
 	lookup, err := WithERPEnvironmentFile(path, func(string) (string, bool) {
@@ -27,14 +28,16 @@ func TestWithERPEnvironmentFileUsesApprovedFallbackValues(t *testing.T) {
 	}
 	if cfg.ShunyunbaoURL != "https://erp.example.test" ||
 		cfg.ShunyunbaoUsername != "dotenv-user" ||
-		cfg.ShunyunbaoPassword != "dotenv password #1" {
+		cfg.ShunyunbaoPassword != "dotenv password #1" ||
+		cfg.OCRAPIURL != "http://127.0.0.1:8000/ocr" {
 		t.Fatalf(
 			"ERP config = %#v",
 			struct {
 				URL      string
 				Username string
 				Password string
-			}{cfg.ShunyunbaoURL, cfg.ShunyunbaoUsername, cfg.ShunyunbaoPassword},
+				OCRURL   string
+			}{cfg.ShunyunbaoURL, cfg.ShunyunbaoUsername, cfg.ShunyunbaoPassword, cfg.OCRAPIURL},
 		)
 	}
 	if _, exists := lookup("OTHER_TOOL_TOKEN"); exists {