feat(t230): use OCR for ERP session login

backend-api/internal/config/config.go

@@ -22,6 +22,7 @@ const (
 	ShunyunbaoURLEnvironment      = "CMROUBAO_SHUNYUNBAO_URL"
 	ShunyunbaoUsernameEnvironment = "CMROUBAO_SHUNYUNBAO_USERNAME"
 	ShunyunbaoPasswordEnvironment = "CMROUBAO_SHUNYUNBAO_PASSWORD"
+	OCRAPIURLEnvironment          = "CMROUBAO_OCR_API_URL"
 
 	defaultHTTPAddress    = "127.0.0.1:8080"
 	defaultDatabasePath   = "var/cmroubao.db"
@@ -52,6 +53,7 @@ type Config struct {
 	ShunyunbaoURL      string
 	ShunyunbaoUsername string
 	ShunyunbaoPassword string
+	OCRAPIURL          string
 	ShunyunbaoTimeout  time.Duration
 }
 
@@ -177,6 +179,13 @@ func Load(lookup LookupEnvironment) (Config, error) {
 				ShunyunbaoPasswordEnvironment + " must be set together",
 		)
 	}
+	ocrAPIURL, ocrAPISet, err := optionalEnvironmentValue(lookup, OCRAPIURLEnvironment)
+	if err != nil {
+		return Config{}, err
+	}
+	if ocrAPISet && !validOCRAPIURL(ocrAPIURL) {
+		return Config{}, errors.New(OCRAPIURLEnvironment + " must be an approved OCR endpoint")
+	}
 
 	return Config{
 		HTTPAddress:        httpAddress,
@@ -196,10 +205,34 @@ func Load(lookup LookupEnvironment) (Config, error) {
 		ShunyunbaoURL:      strings.TrimRight(shunyunbaoURL, "/"),
 		ShunyunbaoUsername: shunyunbaoUsername,
 		ShunyunbaoPassword: shunyunbaoPassword,
+		OCRAPIURL:          ocrAPIURL,
 		ShunyunbaoTimeout:  30 * time.Second,
 	}, nil
 }
 
+func validOCRAPIURL(value string) bool {
+	parsed, err := url.Parse(value)
+	if err != nil || parsed.Host == "" || parsed.User != nil ||
+		parsed.RawQuery != "" || parsed.Fragment != "" || parsed.Path == "" {
+		return false
+	}
+	if port := parsed.Port(); port != "" {
+		parsedPort, portErr := strconv.Atoi(port)
+		if portErr != nil || parsedPort < 1 || parsedPort > 65535 {
+			return false
+		}
+	}
+	if parsed.Scheme == "https" {
+		return true
+	}
+	if parsed.Scheme != "http" {
+		return false
+	}
+	host := strings.Trim(parsed.Hostname(), "[]")
+	return strings.EqualFold(host, "localhost") ||
+		(net.ParseIP(host) != nil && net.ParseIP(host).IsLoopback())
+}
+
 func validateHTTPSOrigin(value, environment string) error {
 	parsed, err := url.Parse(value)
 	if err != nil || parsed.Scheme != "https" || parsed.Host == "" ||