feat(deploy): initialize authentication security secrets

start.ps1

@@ -22,6 +22,7 @@ $script:LogFile = Join-Path $script:Root "start.ps1.log"
 $script:DeployDryRun = ($env:DEPLOY_DRY_RUN -eq "1")
 $script:DeployIP = ""
 $script:SkipDeployQuestions = $false
+$script:SecurityEnvMode = "upgrade"
 $script:DockerDesktopUrl = "https://desktop.docker.com/win/main/amd64/Docker%20Desktop%20Installer.exe"
 
 function Write-Log {
@@ -159,6 +160,7 @@ function Setup-EnvFiles {
     Ensure-FileFromSample ".env.tools" ".env.tools.sample"
     Ensure-FileFromSample ".env.ASG" ".env.ASG.sample"
     Ensure-FileFromSample ".env.AMS" ".env.AMS.sample"
+    if (-not (Test-Path ".env")) { $script:SecurityEnvMode = "new" }
     Ensure-FileFromSample ".env" ".env.sample"
 
     $content = Get-Content ".env" -Raw -Encoding UTF8
@@ -167,6 +169,9 @@ function Setup-EnvFiles {
     $content = Upsert-Env $content "NUXT_PUBLIC_BASE_APIURL" "http://$($script:DeployIP):3001"
     $content = Upsert-Env $content "NUXT_PUBLIC_BASE_SOCKETURL" "ws://$($script:DeployIP):3002"
     $content = Upsert-Env $content "NUXT_PUBLIC_SG_APIURL" "http://$($script:DeployIP):3003"
+    $webPortMatch = [regex]::Match($content, '(?m)^WEB_PORT=(\d+)$')
+    $webPort = if ($webPortMatch.Success) { $webPortMatch.Groups[1].Value } else { "3010" }
+    $content = Upsert-Env $content "CONFIG_SECURITY_ORIGIN" "http://$($script:DeployIP):$webPort"
 
     [System.IO.File]::WriteAllText((Join-Path $script:Root ".env"), $content, [System.Text.UTF8Encoding]::new($false))
     Ok ".env configured for IP=$($script:DeployIP)"
@@ -372,6 +377,9 @@ function Main {
         Ensure-FileFromSample ".env.AMS" ".env.AMS.sample"
     }
 
+    . (Join-Path $script:Root "scripts\Initialize-SecurityEnv.ps1")
+    Initialize-SecurityEnv -Path (Join-Path $script:Root ".env") -Mode $script:SecurityEnvMode
+
     if ($script:DeployDryRun) {
         Warn "dry-run mode: skip docker and services"
     } else {
@@ -388,7 +396,7 @@ function Main {
         Write-Host ""
         Write-Host "  预期访问:  " -NoNewline; Write-Host "http://${ip}:3010" -ForegroundColor Cyan
         Write-Host ""
-        Write-Host "  默认管理员: admin / 123456（启动服务后用于登录）" -ForegroundColor DarkGray
+        Write-Host "  初始管理员: admin；随机密码保存在 .env 的 CONFIG_INITIAL_ADMIN_PASSWORD" -ForegroundColor DarkGray
     } else {
         Write-Host "================================" -ForegroundColor Green
         Write-Host "  部署成功" -ForegroundColor Green
@@ -396,9 +404,9 @@ function Main {
         Write-Host ""
         Write-Host "  访问地址:  " -NoNewline; Write-Host "http://${ip}:3010" -ForegroundColor Cyan
         Write-Host ""
-        Write-Host "  -------- 默认管理员（首次登录后请修改密码）--------" -ForegroundColor Yellow
+        Write-Host "  -------- 初始管理员（首次登录后请修改密码）--------" -ForegroundColor Yellow
         Write-Host "  账号:     " -NoNewline; Write-Host "admin" -ForegroundColor White
-        Write-Host "  密码:     " -NoNewline; Write-Host "123456" -ForegroundColor White
+        Write-Host "  密码位置: " -NoNewline; Write-Host ".env -> CONFIG_INITIAL_ADMIN_PASSWORD" -ForegroundColor White
     }
     Write-Host ""
     Wait-ForExit