# uds-auth defaults — trusted single-instance (not strong multi-tenant)
uacBaseUrl: https://uac.zte.com.cn
userSearchUrl: https://icenterapi.zte.com.cn/zte-km-icenter-addresearch/user/plain/docs/search
loginSystemCode: '100000455558'
originSystemCode: ''
workspaceRoot: ''
# Explicit first super_admin when roles.json is empty (also: UDS_AUTH_INITIAL_ADMIN)
initialAdminEmpNo: ''
# When roles already exist, auto-register unknown UAC users as role=user
allowOpenRegistration: true
# Raw /agent-credentials token response (loopback) — off by default; prefer outbound + task capability
allowRawAgentToken: false
retainSkillCredentialsOnLogout: true
skillCredentialTtlSeconds: 604800
outboundAllowedHosts: icenterapi.zte.com.cn,icentermsg.dt.zte.com.cn
# Optional exact Host allowlist for /uds-auth writes; empty = Origin must match Host only
trustedHosts: ''
# Emergency fallback password is NOT enabled by default. Set via Settings (min 10 chars).
# Legacy Admin@123 hashes are refused on upgrade.