fix(deploy): 限制初始管理员密码长度

scripts/init-security-env.sh

@@ -16,6 +16,20 @@ generate_security_secret() {
     return 1
 }
 
+generate_initial_admin_password() {
+    if command -v openssl >/dev/null 2>&1; then
+        # 10 random bytes encoded as hexadecimal: exactly 20 alphanumeric characters.
+        openssl rand -hex 10 | tr -d '\r\n'
+        return
+    fi
+    if [ -r /dev/urandom ]; then
+        od -An -N10 -tx1 /dev/urandom | tr -d ' \r\n'
+        return
+    fi
+    echo "❌ 无法生成初始管理员密码：需要 openssl 或 /dev/urandom" >&2
+    return 1
+}
+
 read_env_value() {
     local file="$1"
     local key="$2"
@@ -67,6 +81,17 @@ ensure_security_secret() {
     echo "   ✓ 已初始化安全密钥: ${key}"
 }
 
+ensure_initial_admin_password() {
+    local file="$1"
+    local current
+    current="$(read_env_value "$file" "CONFIG_INITIAL_ADMIN_PASSWORD")"
+    if [ "${#current}" -ge 12 ]; then
+        return 0
+    fi
+    write_env_value "$file" "CONFIG_INITIAL_ADMIN_PASSWORD" "$(generate_initial_admin_password)"
+    echo "   ✓ 已初始化管理员密码: CONFIG_INITIAL_ADMIN_PASSWORD"
+}
+
 init_security_env() {
     local file="${1:-.env}"
     local mode="${2:-upgrade}"
@@ -85,7 +110,7 @@ init_security_env() {
         ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET"
         ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER"
         ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY"
-        ensure_security_secret "$file" "CONFIG_INITIAL_ADMIN_PASSWORD" "" 12
+        ensure_initial_admin_password "$file"
     fi
     chmod 600 "$file"
 }