fix(security): 补齐旧部署安全密钥

scripts/test-security-env.sh

@@ -60,22 +60,38 @@ upgrade_log="$TMP_DIR/upgrade.log"
 write_env "$upgrade_env" \
     "CONFIG_JWT_SECRET='this is a very secret secret'" \
     "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY=" \
+    "CONFIG_OTP_HASH_SECRET=" \
+    "CONFIG_AUDIT_HASH_PEPPER=" \
+    "CONFIG_AUDIT_INTEGRITY_KEY=" \
     "WS_AUTH_WS_TICKET_SECRET=" \
     "WS_AUTH_METHODS=none,bearer"
 init_security_env "$upgrade_env" upgrade > "$upgrade_log"
 
 assert_min_length "$upgrade_env" "CONFIG_JWT_SECRET" 32
 assert_min_length "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET" 32
-assert_value "$upgrade_env" "CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY" ""
+for key in \
+    CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \
+    CONFIG_OTP_HASH_SECRET \
+    CONFIG_AUDIT_HASH_PEPPER \
+    CONFIG_AUDIT_INTEGRITY_KEY; do
+    assert_min_length "$upgrade_env" "$key" 32
+done
 assert_value "$upgrade_env" "WS_AUTH_METHODS" "none,bearer,ws_ticket"
 assert_single_key "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET"
 assert_single_key "$upgrade_env" "WS_AUTH_METHODS"
 
-upgrade_jwt="$(read_env_value "$upgrade_env" "CONFIG_JWT_SECRET")"
-upgrade_ws="$(read_env_value "$upgrade_env" "WS_AUTH_WS_TICKET_SECRET")"
-if grep -Fq "$upgrade_jwt" "$upgrade_log" || grep -Fq "$upgrade_ws" "$upgrade_log"; then
-    fail "security initialization output must not reveal generated secrets"
-fi
+for key in \
+    CONFIG_JWT_SECRET \
+    CONFIG_SECURITY_CONFIG_ENCRYPTION_KEY \
+    CONFIG_OTP_HASH_SECRET \
+    CONFIG_AUDIT_HASH_PEPPER \
+    CONFIG_AUDIT_INTEGRITY_KEY \
+    WS_AUTH_WS_TICKET_SECRET; do
+    value="$(read_env_value "$upgrade_env" "$key")"
+    if grep -Fq "$value" "$upgrade_log"; then
+        fail "security initialization output must not reveal generated secrets"
+    fi
+done
 
 before_repeat="$(file_sha256 "$upgrade_env")"
 init_security_env "$upgrade_env" upgrade > "$TMP_DIR/repeat.log"