fix(deploy): 加固 Redis 持久化与旧环境启动配置

2026-09-23 16:20:55 +08:00
parent 26b1cdcdc6
commit 74ada0b0bf
18 changed files with 405 additions and 15 deletions
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# 升级旧部署时补齐浏览器来源；显式配置始终保留并校验。
+# 不 source .env，避免执行环境文件中的内容。
+
+security_origin_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/init-public-api-base-url.sh
+. "${security_origin_script_dir}/init-public-api-base-url.sh"
+
+security_origin_valid() {
+    local value rest
+    value="$(public_url_normalize "$1")"
+    public_url_validate "$value" || return 1
+    rest="${value#*://}"
+    [[ "$rest" != */* ]]
+}
+
+init_security_origin() {
+    local file="${1:-.env}"
+    local api_url origin current item scheme rest authority
+    [ -f "$file" ] || {
+        echo "❌ 环境配置文件不存在: $file" >&2
+        return 1
+    }
+
+    api_url="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
+    public_url_validate "$api_url" || {
+        echo "❌ 请先配置有效的 CONFIG_PUBLIC_API_BASE_URL" >&2
+        return 1
+    }
+    scheme="${api_url%%://*}"
+    rest="${api_url#*://}"
+    authority="${rest%%/*}"
+    origin="${scheme}://${authority}"
+    security_origin_valid "$origin" || return 1
+
+    current="$(public_url_read_env_value "$file" "CONFIG_SECURITY_ORIGIN")"
+    if [ -z "$current" ] || {
+        [ "$current" = 'http://127.0.0.1,http://localhost' ] &&
+        [ "$origin" != 'http://127.0.0.1' ];
+    }; then
+        public_url_write_env_value "$file" "CONFIG_SECURITY_ORIGIN" "$origin"
+        echo "   ✓ 已配置浏览器来源: $origin"
+        return 0
+    fi
+
+    local -a origins
+    case "$current" in
+        ,*|*,|*,,*)
+            echo "❌ CONFIG_SECURITY_ORIGIN 包含空的来源地址" >&2
+            return 1
+            ;;
+    esac
+    IFS=',' read -r -a origins <<< "$current"
+    [ "${#origins[@]}" -gt 0 ] || return 1
+    for item in "${origins[@]}"; do
+        item="$(printf '%s' "$item" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+        if ! security_origin_valid "$item"; then
+            echo "❌ CONFIG_SECURITY_ORIGIN 包含无效或非浏览器来源，请填写 http(s) Origin，不能使用通配符或路径" >&2
+            return 1
+        fi
+    done
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+    init_security_origin "${1:-.env}"
+fi