Revert "fix(security): 补齐旧部署安全密钥"

This reverts commit d01b0e9036.

scripts/Initialize-SecurityEnv.ps1

@@ -57,12 +57,16 @@ function Initialize-SecurityEnv {
     if ($null -eq $content) { $content = "" }
     $definitions = @(
         @{ Key = "CONFIG_JWT_SECRET"; Legacy = "this is a very secret secret"; MinLength = 32 },
+        @{ Key = "WS_AUTH_WS_TICKET_SECRET"; Legacy = ""; MinLength = 32 }
+    )
+    if ($Mode -eq "new") {
+        $definitions += @(
             @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 },
             @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 },
             @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 },
-        @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 },
+            @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 }
-        @{ Key = "WS_AUTH_WS_TICKET_SECRET"; Legacy = ""; MinLength = 32 }
         )
+    }
 
     foreach ($definition in $definitions) {
         $current = Get-EnvValue $content $definition.Key

scripts/Test-SecurityEnv.ps1

@@ -30,24 +30,14 @@ try {
     $upgrade = Write-TestEnv "upgrade.env" @(
         "CONFIG_JWT_SECRET='this is a very secret secret'",
         "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=",
-        "CONFIG_OTP_HASH_SECRET=",
-        "CONFIG_AUDIT_HASH_PEPPER=",
-        "CONFIG_AUDIT_INTEGRITY_KEY=",
         "WS_AUTH_WS_TICKET_SECRET=",
         "WS_AUTH_METHODS=none,bearer"
     )
     Initialize-SecurityEnv -Path $upgrade -Mode upgrade
     $upgradeContent = Get-Content $upgrade -Raw -Encoding UTF8
-    foreach ($key in @(
+    Assert-MinLength $upgradeContent "CONFIG_JWT_SECRET" 32
-        "CONFIG_JWT_SECRET",
+    Assert-MinLength $upgradeContent "WS_AUTH_WS_TICKET_SECRET" 32
-        "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY",
+    Assert-Value $upgradeContent "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" ""
-        "CONFIG_OTP_HASH_SECRET",
-        "CONFIG_AUDIT_HASH_PEPPER",
-        "CONFIG_AUDIT_INTEGRITY_KEY",
-        "WS_AUTH_WS_TICKET_SECRET"
-    )) {
-        Assert-MinLength $upgradeContent $key 32
-    }
     Assert-Value $upgradeContent "WS_AUTH_METHODS" "none,bearer,ws_ticket"
     $upgradeBeforeRepeat = $upgradeContent
     Initialize-SecurityEnv -Path $upgrade -Mode upgrade

scripts/init-security-env.sh

@@ -128,13 +128,13 @@ init_security_env() {
     fi
 
     ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret"
+    ensure_security_secret "$file" "WS_AUTH_WS_TICKET_SECRET"
+    ensure_env_list_item "$file" "WS_AUTH_METHODS" "ws_ticket" "none,bearer"
+    if [ "$mode" = "new" ]; then
         ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"
         ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET"
         ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER"
         ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY"
-    ensure_security_secret "$file" "WS_AUTH_WS_TICKET_SECRET"
-    ensure_env_list_item "$file" "WS_AUTH_METHODS" "ws_ticket" "none,bearer"
-    if [ "$mode" = "new" ]; then
         ensure_initial_admin_password "$file"
     fi
     chmod 600 "$file"

scripts/test-security-env.sh

@@ -60,38 +60,22 @@ upgrade_log="$TMP_DIR/upgrade.log"
 write_env "$upgrade_env" \
     "CONFIG_JWT_SECRET='this is a very secret secret'" \
     "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=" \
-    "CONFIG_OTP_HASH_SECRET=" \
-    "CONFIG_AUDIT_HASH_PEPPER=" \
-    "CONFIG_AUDIT_INTEGRITY_KEY=" \
     "WS_AUTH_WS_TICKET_SECRET=" \
     "WS_AUTH_METHODS=none,bearer"
 init_security_env "$upgrade_env" upgrade > "$upgrade_log"
 
 assert_min_length "$upgrade_env" "CONFIG_JWT_SECRET" 32
 assert_min_length "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET" 32
-for key in \
+assert_value "$upgrade_env" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" ""
-    CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \
-    CONFIG_OTP_HASH_SECRET \
-    CONFIG_AUDIT_HASH_PEPPER \
-    CONFIG_AUDIT_INTEGRITY_KEY; do
-    assert_min_length "$upgrade_env" "$key" 32
-done
 assert_value "$upgrade_env" "WS_AUTH_METHODS" "none,bearer,ws_ticket"
 assert_single_key "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET"
 assert_single_key "$upgrade_env" "WS_AUTH_METHODS"
 
-for key in \
+upgrade_jwt="$(read_env_value "$upgrade_env" "CONFIG_JWT_SECRET")"
-    CONFIG_JWT_SECRET \
+upgrade_ws="$(read_env_value "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET")"
-    CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \
+if grep -Fq "$upgrade_jwt" "$upgrade_log" || grep -Fq "$upgrade_ws" "$upgrade_log"; then
-    CONFIG_OTP_HASH_SECRET \
-    CONFIG_AUDIT_HASH_PEPPER \
-    CONFIG_AUDIT_INTEGRITY_KEY \
-    WS_AUTH_WS_TICKET_SECRET; do
-    value="$(read_env_value "$upgrade_env" "$key")"
-    if grep -Fq "$value" "$upgrade_log"; then
     fail "security initialization output must not reveal generated secrets"
 fi
-done
 
 before_repeat="$(file_sha256 "$upgrade_env")"
 init_security_env "$upgrade_env" upgrade > "$TMP_DIR/repeat.log"