fix(deploy): 加固 Redis 持久化与旧环境启动配置

scripts/Assert-RedisPersistence.ps1

@@ -0,0 +1,29 @@
+# 在 Compose 重建 Redis 前，确认现有 /data 已位于当前项目的数据目录。
+function Assert-RedisPersistence {
+    param([Parameter(Mandatory = $true)][string]$ProjectRoot)
+
+    $null = & docker info 2>&1
+    if ($LASTEXITCODE -ne 0) { throw "Cannot connect to Docker; Redis data location was not checked" }
+
+    $null = & docker container inspect redis 2>&1
+    if ($LASTEXITCODE -ne 0) { return }
+
+    $mount = (& docker inspect --format '{{range .Mounts}}{{if eq .Destination "/data"}}{{.Type}}|{{.Source}}{{end}}{{end}}' redis).Trim()
+    if ($LASTEXITCODE -ne 0 -or -not $mount) {
+        throw "Existing Redis /data is not persisted; migrate AOF/RDB before updating (see README)"
+    }
+    $parts = $mount.Split('|', 2)
+    if ($parts.Count -ne 2 -or $parts[0] -ne 'bind') {
+        throw "Existing Redis /data uses a different storage type; migrate it before updating (see README)"
+    }
+
+    $source = $parts[1]
+    # Docker Desktop 可将 Windows C:\path 显示为 /run/desktop/mnt/host/c/path。
+    $source = $source -replace '^/run/desktop/mnt/host/([A-Za-z])/', '$1:/'
+    $source = $source -replace '^/host_mnt/([A-Za-z])/', '$1:/'
+    $expected = [System.IO.Path]::GetFullPath((Join-Path $ProjectRoot 'data/redis'))
+    $actual = [System.IO.Path]::GetFullPath($source)
+    if (-not [string]::Equals($actual.TrimEnd('\', '/'), $expected.TrimEnd('\', '/'), [StringComparison]::OrdinalIgnoreCase)) {
+        throw "Existing Redis /data uses another directory; migrate it before updating (see README)"
+    }
+}

scripts/Initialize-SecurityOrigin.ps1

@@ -0,0 +1,43 @@
+# 升级旧部署时从公开 API 地址补齐浏览器来源，并校验显式配置。
+. (Join-Path $PSScriptRoot "Initialize-PublicApiBaseUrl.ps1")
+
+function Initialize-SecurityOrigin {
+    param([Parameter(Mandatory = $true)][string]$Path)
+    if (-not (Test-Path $Path)) { throw "Environment file not found: $Path" }
+
+    $content = Get-Content $Path -Raw -Encoding UTF8
+    if ($null -eq $content) { $content = "" }
+    $apiUrl = Get-PublicEnvValue $content "CONFIG_PUBLIC_API_BASE_URL"
+    if (-not (ConvertTo-PublicApiBaseUrl $apiUrl)) {
+        throw "Configure a valid CONFIG_PUBLIC_API_BASE_URL first"
+    }
+    $apiUri = [Uri]$apiUrl
+    $derived = $apiUri.GetLeftPart([UriPartial]::Authority)
+    $current = Get-PublicEnvValue $content "CONFIG_SECURITY_ORIGIN"
+
+    if (-not $current -or
+        ($current -eq "http://127.0.0.1,http://localhost" -and $derived -ne "http://127.0.0.1")) {
+        $content = Set-PublicEnvValue $content "CONFIG_SECURITY_ORIGIN" $derived
+        [System.IO.File]::WriteAllText(
+            (Resolve-Path $Path),
+            $content,
+            [System.Text.UTF8Encoding]::new($false)
+        )
+        Write-Host "   [OK] Browser origin: $derived" -ForegroundColor Green
+        return
+    }
+
+    if ($current.StartsWith(',') -or $current.EndsWith(',') -or $current.Contains(',,')) {
+        throw "CONFIG_SECURITY_ORIGIN contains an empty origin"
+    }
+    foreach ($value in $current.Split(',')) {
+        $origin = $value.Trim()
+        $uri = $null
+        if (-not [Uri]::TryCreate($origin, [UriKind]::Absolute, [ref]$uri) -or
+            $uri.Scheme -notin @('http', 'https') -or
+            $uri.UserInfo -or $uri.Query -or $uri.Fragment -or
+            $uri.AbsolutePath -ne '/' -or -not $uri.Host) {
+            throw "CONFIG_SECURITY_ORIGIN must contain only http(s) origins without paths or wildcards"
+        }
+    }
+}

scripts/Test-RedisPersistence.ps1

@@ -0,0 +1,37 @@
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'Assert-RedisPersistence.ps1')
+
+$projectRoot = Split-Path $PSScriptRoot -Parent
+$expected = [System.IO.Path]::GetFullPath((Join-Path $projectRoot 'data/redis'))
+$script:state = 'absent'
+function docker {
+    $global:LASTEXITCODE = 0
+    switch ($args[0]) {
+        'info' {
+            if ($script:state -eq 'unavailable') { $global:LASTEXITCODE = 1 }
+            return
+        }
+        'container' {
+            if ($script:state -eq 'absent') { $global:LASTEXITCODE = 1 }
+            return
+        }
+        'inspect' {
+            switch ($script:state) {
+                'mounted' { return "bind|$expected" }
+                'wrong_mount' { return 'bind|/other/redis' }
+                default { return '' }
+            }
+        }
+    }
+}
+
+Assert-RedisPersistence -ProjectRoot $projectRoot
+$script:state = 'mounted'
+Assert-RedisPersistence -ProjectRoot $projectRoot
+foreach ($unsafe in @('unavailable', 'no_mount', 'wrong_mount')) {
+    $script:state = $unsafe
+    $rejected = $false
+    try { Assert-RedisPersistence -ProjectRoot $projectRoot } catch { $rejected = $true }
+    if (-not $rejected) { throw "Unsafe Redis state accepted: $unsafe" }
+}
+Write-Host 'Redis persistence PowerShell tests passed'

scripts/Test-SecurityOrigin.ps1

@@ -0,0 +1,34 @@
+$ErrorActionPreference = 'Stop'
+. (Join-Path $PSScriptRoot 'Initialize-SecurityOrigin.ps1')
+
+$tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ("easyai-origin-" + [guid]::NewGuid().ToString('N'))
+New-Item -ItemType Directory -Path $tempDir | Out-Null
+try {
+    $path = Join-Path $tempDir 'test.env'
+    [System.IO.File]::WriteAllText($path, "CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api`n")
+    Initialize-SecurityOrigin -Path $path
+    $content = Get-Content $path -Raw
+    if ((Get-PublicEnvValue $content 'CONFIG_SECURITY_ORIGIN') -ne 'https://zaowua.com') { throw 'Missing origin was not initialized' }
+    $before = $content
+    Initialize-SecurityOrigin -Path $path
+    if ((Get-Content $path -Raw) -ne $before) { throw 'Repeated initialization changed the environment' }
+
+    [System.IO.File]::WriteAllText($path, "CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api`nCONFIG_SECURITY_ORIGIN=http://127.0.0.1,http://localhost`n")
+    Initialize-SecurityOrigin -Path $path
+    if ((Get-PublicEnvValue (Get-Content $path -Raw) 'CONFIG_SECURITY_ORIGIN') -ne 'https://zaowua.com') { throw 'Sample origin was not migrated' }
+
+    [System.IO.File]::WriteAllText($path, "CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api`nCONFIG_SECURITY_ORIGIN=https://zaowua.com,https://www.zaowua.com`n")
+    $before = Get-Content $path -Raw
+    Initialize-SecurityOrigin -Path $path
+    if ((Get-Content $path -Raw) -ne $before) { throw 'Custom origins were not preserved' }
+
+    foreach ($invalid in @('*', 'https://zaowua.com/api', 'https://zaowua.com,', 'https://user:pass@zaowua.com')) {
+        [System.IO.File]::WriteAllText($path, "CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api`nCONFIG_SECURITY_ORIGIN=$invalid`n")
+        $rejected = $false
+        try { Initialize-SecurityOrigin -Path $path } catch { $rejected = $true }
+        if (-not $rejected) { throw "Accepted invalid origin: $invalid" }
+    }
+    Write-Host 'Security origin PowerShell tests passed'
+} finally {
+    Remove-Item -Recurse -Force $tempDir
+}

scripts/check-redis-persistence.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+# 在 Compose 可能重建 Redis 前，阻止把容器写层或旧 volume 中的数据静默替换为空目录。
+set -euo pipefail
+
+project_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+expected_dir="$(cd "${project_dir}/data" && pwd -P)/redis"
+container="${REDIS_CONTAINER_NAME:-redis}"
+
+if ! docker info >/dev/null 2>&1; then
+    echo "❌ 无法连接 Docker，未检查 Redis 数据位置，停止部署" >&2
+    exit 1
+fi
+
+if ! docker container inspect "$container" >/dev/null 2>&1; then
+    exit 0
+fi
+
+mount="$(docker inspect --format '{{range .Mounts}}{{if eq .Destination "/data"}}{{.Type}}|{{.Source}}{{end}}{{end}}' "$container")"
+if [ "$mount" != "bind|$expected_dir" ]; then
+    echo "❌ 现有 Redis 的 /data 未挂载到 ${expected_dir}，停止部署以保护 AOF/RDB 数据" >&2
+    echo "   请按 README 的 Redis 数据迁移步骤先备份、停机、复制并校验，再重建 Redis" >&2
+    exit 1
+fi

scripts/init-security-origin.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# 升级旧部署时补齐浏览器来源；显式配置始终保留并校验。
+# 不 source .env，避免执行环境文件中的内容。
+
+security_origin_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/init-public-api-base-url.sh
+. "${security_origin_script_dir}/init-public-api-base-url.sh"
+
+security_origin_valid() {
+    local value rest
+    value="$(public_url_normalize "$1")"
+    public_url_validate "$value" || return 1
+    rest="${value#*://}"
+    [[ "$rest" != */* ]]
+}
+
+init_security_origin() {
+    local file="${1:-.env}"
+    local api_url origin current item scheme rest authority
+    [ -f "$file" ] || {
+        echo "❌ 环境配置文件不存在: $file" >&2
+        return 1
+    }
+
+    api_url="$(public_url_read_env_value "$file" "CONFIG_PUBLIC_API_BASE_URL")"
+    public_url_validate "$api_url" || {
+        echo "❌ 请先配置有效的 CONFIG_PUBLIC_API_BASE_URL" >&2
+        return 1
+    }
+    scheme="${api_url%%://*}"
+    rest="${api_url#*://}"
+    authority="${rest%%/*}"
+    origin="${scheme}://${authority}"
+    security_origin_valid "$origin" || return 1
+
+    current="$(public_url_read_env_value "$file" "CONFIG_SECURITY_ORIGIN")"
+    if [ -z "$current" ] || {
+        [ "$current" = 'http://127.0.0.1,http://localhost' ] &&
+        [ "$origin" != 'http://127.0.0.1' ];
+    }; then
+        public_url_write_env_value "$file" "CONFIG_SECURITY_ORIGIN" "$origin"
+        echo "   ✓ 已配置浏览器来源: $origin"
+        return 0
+    fi
+
+    local -a origins
+    case "$current" in
+        ,*|*,|*,,*)
+            echo "❌ CONFIG_SECURITY_ORIGIN 包含空的来源地址" >&2
+            return 1
+            ;;
+    esac
+    IFS=',' read -r -a origins <<< "$current"
+    [ "${#origins[@]}" -gt 0 ] || return 1
+    for item in "${origins[@]}"; do
+        item="$(printf '%s' "$item" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+        if ! security_origin_valid "$item"; then
+            echo "❌ CONFIG_SECURITY_ORIGIN 包含无效或非浏览器来源，请填写 http(s) Origin，不能使用通配符或路径" >&2
+            return 1
+        fi
+    done
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+    init_security_origin "${1:-.env}"
+fi

scripts/test-deployment-public-url.sh

@@ -19,8 +19,10 @@ cp \
 mkdir -p "$TMP_DIR/scripts"
 cp \
     "$REPO_ROOT/scripts/init-security-env.sh" \
+    "$REPO_ROOT/scripts/init-security-origin.sh" \
     "$REPO_ROOT/scripts/init-public-api-base-url.sh" \
     "$REPO_ROOT/scripts/init-server-http-bind-ip.sh" \
+    "$REPO_ROOT/scripts/check-redis-persistence.sh" \
     "$TMP_DIR/scripts/"
 
 cd "$TMP_DIR"
@@ -112,6 +114,17 @@ assert "ws_ticket" in methods, f"ws-gateway does not advertise ws_ticket: {sorte
 '
 }
 
+assert_redis_startup_contract() {
+    docker compose config --format json | python3 -c '
+import json, sys
+services = json.load(sys.stdin)["services"]
+redis = services["redis"]
+assert any(volume.get("target") == "/data" for volume in redis.get("volumes") or []), redis.get("volumes")
+assert redis["healthcheck"]["test"] == ["CMD", "redis-cli", "ping"]
+assert services["easyai-server"]["depends_on"]["redis"]["condition"] == "service_healthy"
+'
+}
+
 assert_compose_security() {
     docker compose config --format json | python3 -c '
 import json, sys
@@ -188,6 +201,7 @@ if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1;
     assert_compose_exposure 127.0.0.1 127.0.0.1
     assert_canvas_ws_auth_config
     assert_compose_security
+    assert_redis_startup_contract
 fi
 
 reset_case

scripts/test-redis-persistence-guard.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+cat > "$tmp_dir/docker" <<'SH'
+#!/usr/bin/env bash
+case "$1" in
+    info) [ "${DOCKER_STUB_STATE:-}" != unavailable ] ;;
+    container) [ "${DOCKER_STUB_STATE:-}" != absent ] ;;
+    inspect) printf '%s\n' "${DOCKER_STUB_MOUNT:-}" ;;
+    *) exit 2 ;;
+esac
+SH
+chmod +x "$tmp_dir/docker"
+export PATH="$tmp_dir:$PATH"
+
+DOCKER_STUB_STATE=absent "$script_dir/check-redis-persistence.sh"
+DOCKER_STUB_MOUNT="bind|$(cd "$script_dir/../data" && pwd -P)/redis" "$script_dir/check-redis-persistence.sh"
+
+for state in unavailable no_mount wrong_mount; do
+    case "$state" in
+        unavailable) export DOCKER_STUB_STATE=unavailable DOCKER_STUB_MOUNT='' ;;
+        no_mount) export DOCKER_STUB_STATE=present DOCKER_STUB_MOUNT='' ;;
+        wrong_mount) export DOCKER_STUB_STATE=present DOCKER_STUB_MOUNT='bind|/other/redis' ;;
+    esac
+    if "$script_dir/check-redis-persistence.sh" > /dev/null 2>&1; then
+        echo "unsafe Redis state accepted: $state" >&2
+        exit 1
+    fi
+done
+
+echo 'Redis persistence guard tests passed'

scripts/test-security-origin.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=scripts/init-security-origin.sh
+. "${script_dir}/init-security-origin.sh"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_value() {
+    local actual
+    actual="$(public_url_read_env_value "$1" CONFIG_SECURITY_ORIGIN)"
+    [ "$actual" = "$2" ] || { echo "unexpected origin: $actual" >&2; exit 1; }
+}
+
+cat > "$tmp_dir/missing.env" <<'ENV'
+CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
+ENV
+init_security_origin "$tmp_dir/missing.env" > /dev/null
+assert_value "$tmp_dir/missing.env" 'https://zaowua.com'
+first_hash="$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)"
+init_security_origin "$tmp_dir/missing.env" > /dev/null
+[ "$first_hash" = "$(shasum -a 256 "$tmp_dir/missing.env" | cut -d ' ' -f 1)" ]
+
+cat > "$tmp_dir/sample.env" <<'ENV'
+CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
+CONFIG_SECURITY_ORIGIN=http://127.0.0.1,http://localhost
+ENV
+init_security_origin "$tmp_dir/sample.env" > /dev/null
+assert_value "$tmp_dir/sample.env" 'https://zaowua.com'
+
+cat > "$tmp_dir/preserved.env" <<'ENV'
+CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api
+CONFIG_SECURITY_ORIGIN=https://zaowua.com,https://www.zaowua.com
+ENV
+before="$(shasum -a 256 "$tmp_dir/preserved.env" | cut -d ' ' -f 1)"
+init_security_origin "$tmp_dir/preserved.env" > /dev/null
+[ "$before" = "$(shasum -a 256 "$tmp_dir/preserved.env" | cut -d ' ' -f 1)" ]
+
+for invalid in '*' 'https://zaowua.com/api' 'https://zaowua.com,' 'https://user:pass@zaowua.com'; do
+    printf 'CONFIG_PUBLIC_API_BASE_URL=https://zaowua.com/api\nCONFIG_SECURITY_ORIGIN=%s\n' "$invalid" > "$tmp_dir/invalid.env"
+    if init_security_origin "$tmp_dir/invalid.env" > /dev/null 2>&1; then
+        echo "accepted invalid origin: $invalid" >&2
+        exit 1
+    fi
+done
+
+echo 'Security origin migration tests passed'