fix version 1

pkgs/all/internal/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"log"
 	"net"
 	"os"
 	"strings"
@@ -53,6 +54,17 @@ type AuthorizationConfig struct {
 
 var Spec SrvConfig
 
+// publicJwtSecretKeys 是仓库中出现过的公开 JWT 密钥字面量，绝不允许被当作有效签名密钥使用：
+//   - CHANGE_ME_32_BYTE_JWT_SECRET_KEY：历史样例值（恰好 32 字节，能通过长度校验）；
+//   - Cblocksmesh2022C：bsm-sdk env.NewEnv() 的内置默认值（SDK 不可改，只能在此拒绝）。
+var publicJwtSecretKeys = map[string]struct{}{
+	"CHANGE_ME_32_BYTE_JWT_SECRET_KEY": {},
+	"Cblocksmesh2022C":                 {},
+}
+
+// publicSessionSecret 是 session cookie HMAC 密钥的公开占位值。
+const publicSessionSecret = "CHANGE_ME"
+
 func New(serviceKey string) {
 	conf.New(serviceKey, &Spec)
 	normalizeListener(&Spec.Server.GRPC)
@@ -60,16 +72,30 @@ func New(serviceKey string) {
 	if Spec.Server.GRPC.Addr == Spec.Server.HTTP.Addr {
 		panic("gRPC and HTTP listeners must use different addresses")
 	}
-	if strings.TrimSpace(Spec.Authorization.Key) == "" {
-		panic("Authorization.Key must not be empty")
+	// JWT 是全系统身份凭据，签名密钥必须由部署显式提供：优先取 BSM_JwtSecretKey 环境变量，
+	// 空值与公开样例值一律拒绝启动，避免默认配置直接上线后被用于伪造任意身份。
+	if envKey := strings.TrimSpace(os.Getenv("BSM_JwtSecretKey")); envKey != "" {
+		Spec.Authorization.Key = envKey
+	}
+	Spec.Authorization.Key = strings.TrimSpace(Spec.Authorization.Key)
+	if Spec.Authorization.Key == "" {
+		log.Fatalln("ERROR: JWT secret is not configured; provide it through the BSM_JwtSecretKey environment variable")
+	}
+	if _, isPublic := publicJwtSecretKeys[Spec.Authorization.Key]; isPublic {
+		log.Fatalln("ERROR: JWT secret is a public sample value; provide a private key through the BSM_JwtSecretKey environment variable")
 	}
 	keyLength := len(Spec.Authorization.Key)
 	if keyLength != 16 && keyLength != 24 && keyLength != 32 {
-		panic("Authorization.Key must contain 16, 24, or 32 bytes")
+		log.Fatalln("ERROR: JWT secret must contain 16, 24, or 32 bytes")
 	}
 	if Spec.Authorization.Expire <= 0 {
 		panic("Authorization.Expire must be greater than zero")
 	}
+	// session cookie 的 HMAC 密钥同样不得为空或公开占位值。
+	sessionSecret := strings.TrimSpace(Spec.SecretKey)
+	if sessionSecret == "" || sessionSecret == publicSessionSecret {
+		log.Fatalln("ERROR: SecretKey must not be empty or a public placeholder; provide a private secret through the BSM_SECRET_KEY environment variable")
+	}
 	env.NewEnv().JwtSecretKey = Spec.Authorization.Key
 	coreVars.JwtExpire = time.Duration(Spec.Authorization.Expire) * time.Second
 	// Keep the embedded base address meaningful for module configurations that