From 618997c8861236224e5b6ea14dfcb87aa3f505aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=BE=90=E5=8B=A4=E6=B0=91?= <xuqinmin@bjca.org.cn>
Date: Wed, 29 Jul 2026 01:37:09 +0800
Subject: [PATCH] fix(security): migrate internal service token

---
 scripts/deploy.sh |  2 ++
 scripts/lib.sh    | 22 ++++++++++++++++++++++
 scripts/reset.sh  |  3 +++
 scripts/update.sh |  3 +++
 4 files changed, 30 insertions(+)

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 4e682c0..fbedcda 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -442,6 +442,8 @@ ok "config/secrets.env 已写入 (chmod 600)"
 # secrets.env，安装输出和交付文档均不得展示其内容。
 # shellcheck disable=SC1091
 . "$ROOT_DIR/scripts/lib.sh"
+ensure_internal_service_token "$ROOT_DIR/config/secrets.env" \
+  || fail "内部服务令牌初始化失败"
 ensure_sdk_config_signing_keypair "$ROOT_DIR/config/secrets.env" \
   || fail "SDK 配置签名密钥初始化失败"
 ok "SDK 配置签名密钥已生成"
diff --git a/scripts/lib.sh b/scripts/lib.sh
index 6e51053..003926e 100755
--- a/scripts/lib.sh
+++ b/scripts/lib.sh
@@ -105,6 +105,28 @@ ensure_env_value() {
   fi
 }
 
+ensure_internal_service_token() {
+  local secrets_file="${1:-$ROOT_DIR/config/secrets.env}"
+  local current generated
+
+  if [ ! -f "$secrets_file" ]; then
+    mkdir -p "$(dirname "$secrets_file")"
+    cp "$ROOT_DIR/config/secrets.env.example" "$secrets_file"
+  fi
+  current="$(grep '^SDK_INTERNAL_TOKEN=' "$secrets_file" 2>/dev/null | cut -d= -f2- || true)"
+  if [ -n "$current" ] && [ "$current" != "xuqm-internal-token" ] && [ "$current" != "change-me" ]; then
+    return 0
+  fi
+
+  generated="$(random_secret)"
+  [ -n "$generated" ] || {
+    printf '生成内部服务令牌失败\n' >&2
+    return 1
+  }
+  set_env_value "$secrets_file" "SDK_INTERNAL_TOKEN" "$generated"
+  chmod 600 "$secrets_file" || true
+}
+
 ensure_sdk_config_signing_keypair() {
   local secrets_file="${1:-$ROOT_DIR/config/secrets.env}"
   local private_key public_key key_id key_dir
diff --git a/scripts/reset.sh b/scripts/reset.sh
index 429f1f2..7da5938 100644
--- a/scripts/reset.sh
+++ b/scripts/reset.sh
@@ -105,6 +105,9 @@ fi
 # reset 也可能是旧部署升级后的首次入口，必须补齐服务启动所需的签名信任根。
 # shellcheck disable=SC1091
 . "$ROOT_DIR/scripts/lib.sh"
+ensure_internal_service_token "$ROOT_DIR/config/secrets.env" \
+  || fail "内部服务令牌初始化失败"
+ok "内部服务令牌已就绪"
 ensure_sdk_config_signing_keypair "$ROOT_DIR/config/secrets.env" \
   || fail "SDK 配置签名密钥初始化失败"
 ok "SDK 配置签名密钥已就绪"
diff --git a/scripts/update.sh b/scripts/update.sh
index bbec1b8..25b0d95 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -162,6 +162,9 @@ fi
 # 生成一次并永久保留；只存在半套配置时拒绝自动轮换，避免已签发配置突然失效。
 # shellcheck disable=SC1091
 . "$ROOT_DIR/scripts/lib.sh"
+ensure_internal_service_token "$ROOT_DIR/config/secrets.env" \
+  || fail "内部服务令牌初始化失败"
+ok "内部服务令牌已就绪"
 ensure_sdk_config_signing_keypair "$ROOT_DIR/config/secrets.env" \
   || fail "SDK 配置签名密钥初始化失败"
 ok "SDK 配置签名密钥已就绪"