Merge pull request #40 from kylin987/main

安装时随机生成64位的密钥

Author: Tinywan

src/Install.php

@@ -5,6 +5,8 @@
 class Install
 {
     public const WEBMAN_PLUGIN = true;
+    private const ACCESS_PLACEHOLDER = '__JWT_ACCESS_SECRET_KEY__';
+    private const REFRESH_PLACEHOLDER = '__JWT_REFRESH_SECRET_KEY__';
 
     /**
      * @var array
@@ -46,6 +48,45 @@ public static function installByRelation()
             }
             //symlink(__DIR__ . "/$source", base_path()."/$dest");
             copy_dir(__DIR__ . "/$source", base_path()."/$dest");
+            self::initJwtSecrets(base_path()."/$dest/app.php");
+        }
+    }
+
+    /**
+     * 安装时初始化JWT密钥（64位随机字符串）
+     * @param string $configFile
+     * @return void
+     */
+    protected static function initJwtSecrets(string $configFile): void
+    {
+        if (!is_file($configFile) || !is_readable($configFile) || !is_writable($configFile)) {
+            return;
+        }
+
+        $content = file_get_contents($configFile);
+        if (!is_string($content) || $content === '') {
+            return;
+        }
+
+        if (strpos($content, self::ACCESS_PLACEHOLDER) === false && strpos($content, self::REFRESH_PLACEHOLDER) === false) {
+            return;
+        }
+
+        try {
+            $accessKey = bin2hex(random_bytes(32));
+            $refreshKey = bin2hex(random_bytes(32));
+        } catch (\Exception $e) {
+            return;
+        }
+
+        $updated = str_replace(
+            [self::ACCESS_PLACEHOLDER, self::REFRESH_PLACEHOLDER],
+            [$accessKey, $refreshKey],
+            $content
+        );
+
+        if ($updated !== $content) {
+            file_put_contents($configFile, $updated);
         }
     }
 

src/config/plugin/tinywan/jwt/app.php

@@ -6,14 +6,14 @@
         /** 算法类型 HS256、HS384、HS512、RS256、RS384、RS512、ES256、ES384、ES512、PS256、PS384、PS512 */
         'algorithms' => 'HS256',
 
-        /** access令牌秘钥 */
-        'access_secret_key' => '5e923d88405f79ad02e9161183853e57ece80c65315ff684c5e7efde25881f28',
+        /** access令牌秘钥（安装时自动生成64位随机值） */
+        'access_secret_key' => '__JWT_ACCESS_SECRET_KEY__',
 
         /** access令牌过期时间，单位：秒。默认 2 小时 */
         'access_exp' => 7200,
 
-        /** refresh令牌秘钥 */
-        'refresh_secret_key' => '0c7fc8d5e58be9a5d59527be32740ba5c3c85dc534e8d90a402a529cac94366a',
+        /** refresh令牌秘钥（安装时自动生成64位随机值） */
+        'refresh_secret_key' => '__JWT_REFRESH_SECRET_KEY__',
 
         /** refresh令牌过期时间，单位：秒。默认 7 天 */
         'refresh_exp' => 604800,