From a95d3b7d4b04a2ad3ee7402b682026a9eb68fe73 Mon Sep 17 00:00:00 2001
From: Hermes Agent <agent@gaokao.local>
Date: Tue, 16 Jun 2026 11:02:54 +0800
Subject: [PATCH] fix(deploy): pass prod payment env vars into compose

---
 docker-compose.yml                        | 12 +++++++
 tests/test_docker_compose_env_contract.py | 38 +++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 tests/test_docker_compose_env_contract.py

diff --git a/docker-compose.yml b/docker-compose.yml
index 20451f5..5018c9a 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,14 +10,26 @@ services:
     restart: unless-stopped
     environment:
       GAOKAO_ENV: ${GAOKAO_ENV:-dev}
+      GAOKAO_ADMIN_BIND: ${GAOKAO_ADMIN_BIND:-127.0.0.1}
+      GAOKAO_ADMIN_PORT: ${GAOKAO_ADMIN_PORT:-8000}
       GAOKAO_JWT_SECRET: ${GAOKAO_JWT_SECRET:-dev-only-local-jwt-secret-please-override-before-production-1234567890abcdef}
       GAOKAO_ADMIN_USER: ${GAOKAO_ADMIN_USER:-admin}
       GAOKAO_ADMIN_PASS: ${GAOKAO_ADMIN_PASS:-dev-only-local-admin-pass-please-change}
+      GAOKAO_PORTAL_TOKEN_SECRET: ${GAOKAO_PORTAL_TOKEN_SECRET:-dev-only-local-portal-token-secret-please-override-before-production-abcdef1234567890}
       GAOKAO_ORDERS_FERNET_KEY: ${GAOKAO_ORDERS_FERNET_KEY:-dev-only-local-orders-fernet-key-please-change}
       GAOKAO_DB_PATH: /var/lib/gaokao/orders/admin.db
       GAOKAO_ORDERS_DB_PATH: /var/lib/gaokao/orders.db
       GAOKAO_SHARE_DB_PATH: /var/lib/gaokao/share/short_links.db
       GAOKAO_SHARE_REPORT_DIR: /var/lib/gaokao/share/reports
+      GAOKAO_PAYMENT_PROVIDER: ${GAOKAO_PAYMENT_PROVIDER:-mock}
+      GAOKAO_PAYMENT_BASE_URL: ${GAOKAO_PAYMENT_BASE_URL:-https://example.com}
+      GAOKAO_PAYMENT_WEBHOOK_SECRET: ${GAOKAO_PAYMENT_WEBHOOK_SECRET:-dev-only-local-payment-webhook-secret-please-change-before-production-1234567890abcdef}
+      GAOKAO_PAYMENT_NOTIFY_URL: ${GAOKAO_PAYMENT_NOTIFY_URL:-}
+      GAOKAO_PAYMENT_RETURN_URL: ${GAOKAO_PAYMENT_RETURN_URL:-}
+      GAOKAO_PAYMENT_APP_ID: ${GAOKAO_PAYMENT_APP_ID:-}
+      GAOKAO_PAYMENT_PRIVATE_KEY_PATH: ${GAOKAO_PAYMENT_PRIVATE_KEY_PATH:-}
+      GAOKAO_PAYMENT_ALIPAY_PUBLIC_KEY_PATH: ${GAOKAO_PAYMENT_ALIPAY_PUBLIC_KEY_PATH:-}
+      GAOKAO_OPS_ALERT_LOG: ${GAOKAO_OPS_ALERT_LOG:-/var/lib/gaokao/ops-alerts.jsonl}
     ports:
       - "${GAOKAO_ADMIN_BIND:-127.0.0.1}:${GAOKAO_ADMIN_PORT:-8000}:8000"
     volumes:
diff --git a/tests/test_docker_compose_env_contract.py b/tests/test_docker_compose_env_contract.py
new file mode 100644
index 0000000..f88b308
--- /dev/null
+++ b/tests/test_docker_compose_env_contract.py
@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_docker_compose_passes_prod_critical_gaokao_env_vars() -> None:
+    compose = yaml.safe_load(
+        (PROJECT_ROOT / "docker-compose.yml").read_text(encoding="utf-8")
+    )
+    service_env = compose["services"]["gaokao-admin"]["environment"]
+
+    required_keys = {
+        "GAOKAO_ENV",
+        "GAOKAO_ADMIN_BIND",
+        "GAOKAO_ADMIN_PORT",
+        "GAOKAO_ADMIN_USER",
+        "GAOKAO_ADMIN_PASS",
+        "GAOKAO_JWT_SECRET",
+        "GAOKAO_PORTAL_TOKEN_SECRET",
+        "GAOKAO_ORDERS_FERNET_KEY",
+        "GAOKAO_PAYMENT_PROVIDER",
+        "GAOKAO_PAYMENT_BASE_URL",
+        "GAOKAO_PAYMENT_WEBHOOK_SECRET",
+        "GAOKAO_PAYMENT_NOTIFY_URL",
+        "GAOKAO_PAYMENT_RETURN_URL",
+        "GAOKAO_PAYMENT_APP_ID",
+        "GAOKAO_PAYMENT_PRIVATE_KEY_PATH",
+        "GAOKAO_PAYMENT_ALIPAY_PUBLIC_KEY_PATH",
+        "GAOKAO_OPS_ALERT_LOG",
+    }
+
+    missing = sorted(required_keys - set(service_env))
+    assert not missing, f"docker-compose.yml missing gaokao env pass-through: {missing}"