feat(deploy): initialize authentication security secrets

2026-07-15 11:29:41 +08:00
parent 2a40ad91c8
commit 64bbf5c109
7 changed files with 238 additions and 4 deletions
@@ -0,0 +1,74 @@
+function New-SecuritySecret {
+    $bytes = New-Object byte[] 48
+    $rng = [System.Security.Cryptography.RandomNumberGenerator]::Create()
+    try {
+        $rng.GetBytes($bytes)
+    } finally {
+        $rng.Dispose()
+    }
+    return [Convert]::ToBase64String($bytes)
+}
+
+function Get-EnvValue {
+    param([string]$Content, [string]$Key)
+    $match = [regex]::Match($Content, "(?m)^$([regex]::Escape($Key))=(.*)$")
+    if (-not $match.Success) { return "" }
+    $value = $match.Groups[1].Value.Trim()
+    if ($value.Length -ge 2) {
+        $first = $value.Substring(0, 1)
+        $last = $value.Substring($value.Length - 1, 1)
+        if (($first -eq "'" -and $last -eq "'") -or ($first -eq '"' -and $last -eq '"')) {
+            return $value.Substring(1, $value.Length - 2)
+        }
+    }
+    return $value
+}
+
+function Set-EnvValue {
+    param([string]$Content, [string]$Key, [string]$Value)
+    $pattern = "(?m)^$([regex]::Escape($Key))=.*(?:\r?\n)?"
+    $replacement = "$Key=$Value`r`n"
+    if ([regex]::IsMatch($Content, $pattern)) {
+        return [regex]::Replace($Content, $pattern, $replacement, 1)
+    }
+    if ($Content -and -not $Content.EndsWith("`n")) { $Content += "`r`n" }
+    return $Content + $replacement
+}
+
+function Initialize-SecurityEnv {
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [ValidateSet("new", "upgrade")][string]$Mode = "upgrade"
+    )
+    if (-not (Test-Path $Path)) { throw "Environment file not found: $Path" }
+
+    $content = Get-Content $Path -Raw -Encoding UTF8
+    if ($null -eq $content) { $content = "" }
+    $definitions = @(
+        @{ Key = "CONFIG_JWT_SECRET"; Legacy = "this is a very secret secret"; MinLength = 32 }
+    )
+    if ($Mode -eq "new") {
+        $definitions += @(
+            @{ Key = "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"; Legacy = ""; MinLength = 32 },
+            @{ Key = "CONFIG_OTP_HASH_SECRET"; Legacy = ""; MinLength = 32 },
+            @{ Key = "CONFIG_AUDIT_HASH_PEPPER"; Legacy = ""; MinLength = 32 },
+            @{ Key = "CONFIG_AUDIT_INTEGRITY_KEY"; Legacy = ""; MinLength = 32 },
+            @{ Key = "CONFIG_INITIAL_ADMIN_PASSWORD"; Legacy = ""; MinLength = 12 }
+        )
+    }
+
+    foreach ($definition in $definitions) {
+        $current = Get-EnvValue $content $definition.Key
+        $needsInitialization = $current.Length -lt $definition.MinLength -or
+            ($definition.Legacy -and $current -eq $definition.Legacy)
+        if (-not $needsInitialization) { continue }
+        $content = Set-EnvValue $content $definition.Key (New-SecuritySecret)
+        Write-Host "   [OK] Initialized security secret: $($definition.Key)" -ForegroundColor Green
+    }
+
+    [System.IO.File]::WriteAllText(
+        (Resolve-Path $Path),
+        $content,
+        [System.Text.UTF8Encoding]::new($false)
+    )
+}