feat(deploy): initialize authentication security secrets

2026-07-15 11:29:41 +08:00
parent 2a40ad91c8
commit 64bbf5c109
7 changed files with 238 additions and 4 deletions
@@ -0,0 +1,95 @@
+#!/bin/bash
+
+# 为本地 .env 初始化持久化安全密钥。只处理空值和已知历史默认值，
+# 已存在的自定义值保持不变；数据库中的 JWT 轮转配置仍由后端优先使用。
+
+generate_security_secret() {
+    if command -v openssl >/dev/null 2>&1; then
+        openssl rand -base64 48 | tr -d '\r\n'
+        return
+    fi
+    if [ -r /dev/urandom ]; then
+        od -An -N48 -tx1 /dev/urandom | tr -d ' \r\n'
+        return
+    fi
+    echo "❌ 无法生成安全随机值：需要 openssl 或 /dev/urandom" >&2
+    return 1
+}
+
+read_env_value() {
+    local file="$1"
+    local key="$2"
+    local value
+    value="$(awk -v key="$key" 'index($0, key "=") == 1 { print substr($0, length(key) + 2); exit }' "$file")"
+    value="$(printf '%s' "$value" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+    case "$value" in
+        \"*\") value="${value#\"}"; value="${value%\"}" ;;
+        \'*\') value="${value#\'}"; value="${value%\'}" ;;
+    esac
+    printf '%s' "$value"
+}
+
+write_env_value() {
+    local file="$1"
+    local key="$2"
+    local value="$3"
+    local tmp
+    tmp="$(mktemp "${file}.tmp.XXXXXX")"
+    awk -v key="$key" -v value="$value" '
+        BEGIN { replaced = 0 }
+        index($0, key "=") == 1 {
+            if (!replaced) {
+                print key "=" value
+                replaced = 1
+            }
+            next
+        }
+        { print }
+        END {
+            if (!replaced) print key "=" value
+        }
+    ' "$file" > "$tmp"
+    chmod 600 "$tmp"
+    mv "$tmp" "$file"
+}
+
+ensure_security_secret() {
+    local file="$1"
+    local key="$2"
+    local legacy_value="${3:-}"
+    local minimum_length="${4:-32}"
+    local current
+    current="$(read_env_value "$file" "$key")"
+    if [ "${#current}" -ge "$minimum_length" ] && { [ -z "$legacy_value" ] || [ "$current" != "$legacy_value" ]; }; then
+        return 0
+    fi
+    write_env_value "$file" "$key" "$(generate_security_secret)"
+    echo "   ✓ 已初始化安全密钥: ${key}"
+}
+
+init_security_env() {
+    local file="${1:-.env}"
+    local mode="${2:-upgrade}"
+    if [ ! -f "$file" ]; then
+        echo "❌ 环境配置文件不存在: $file" >&2
+        return 1
+    fi
+    if [ "$mode" != "new" ] && [ "$mode" != "upgrade" ]; then
+        echo "❌ 安全环境初始化模式无效: $mode（仅支持 new/upgrade）" >&2
+        return 1
+    fi
+
+    ensure_security_secret "$file" "CONFIG_JWT_SECRET" "this is a very secret secret"
+    if [ "$mode" = "new" ]; then
+        ensure_security_secret "$file" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY"
+        ensure_security_secret "$file" "CONFIG_OTP_HASH_SECRET"
+        ensure_security_secret "$file" "CONFIG_AUDIT_HASH_PEPPER"
+        ensure_security_secret "$file" "CONFIG_AUDIT_INTEGRITY_KEY"
+        ensure_security_secret "$file" "CONFIG_INITIAL_ADMIN_PASSWORD" "" 12
+    fi
+    chmod 600 "$file"
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+    init_security_env "${1:-.env}" "${2:-upgrade}"
+fi