feat(deploy): 自动初始化画布协作认证密钥

scripts/test-deployment-public-url.sh

@@ -77,6 +77,21 @@ assert server_ports[0].get("host_ip") == expected, server_ports
 ' "$expected_server_host_ip"
 }
 
+assert_canvas_ws_auth_config() {
+    docker compose config --format json | python3 -c '
+import json, sys
+config = json.load(sys.stdin)
+server_env = config["services"]["easyai-server"].get("environment") or {}
+gateway_env = config["services"]["ws-gateway"].get("environment") or {}
+server_secret = str(server_env.get("WS_AUTH_WS_TICKET_SECRET") or "")
+gateway_secret = str(gateway_env.get("WS_AUTH_WS_TICKET_SECRET") or "")
+assert len(server_secret.encode()) >= 32, "server-main WS ticket secret is missing or too short"
+assert server_secret == gateway_secret, "server-main and ws-gateway WS ticket secrets differ"
+methods = {item.strip() for item in str(gateway_env.get("WS_AUTH_METHODS") or "").split(",") if item.strip()}
+assert "ws_ticket" in methods, f"ws-gateway does not advertise ws_ticket: {sorted(methods)}"
+'
+}
+
 sed -i.bak 's/^SERVER_HTTP_PORT=.*/SERVER_HTTP_PORT=4100/' .env.sample
 rm -f .env.sample.bak
 DEPLOY_NON_INTERACTIVE=1 \
@@ -89,6 +104,7 @@ grep -qx 'CONFIG_PUBLIC_API_BASE_URL=http://10.0.0.8:4100' .env
 grep -qx 'SERVER_HTTP_BIND_IP=0.0.0.0' .env
 if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
     assert_compose_exposure 0.0.0.0
+    assert_canvas_ws_auth_config
 fi
 
 reset_case