fix version 1

pkgs/ecmall/internal/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"log"
 	"net"
 	"os"
 	"strings"
@@ -59,6 +60,17 @@ type AuthorizationConfig struct {
 
 var Spec SrvConfig
 
+// publicJwtSecretKeys 是仓库中出现过的公开 JWT 密钥字面量，绝不允许被当作有效签名密钥使用：
+//   - CHANGE_ME_32_BYTE_JWT_SECRET_KEY：历史样例值（恰好 32 字节，能通过长度校验）；
+//   - Cblocksmesh2022C：bsm-sdk env.NewEnv() 的内置默认值（SDK 不可改，只能在此拒绝）。
+var publicJwtSecretKeys = map[string]struct{}{
+	"CHANGE_ME_32_BYTE_JWT_SECRET_KEY": {},
+	"Cblocksmesh2022C":                 {},
+}
+
+// publicSessionSecret 是 session cookie HMAC 密钥的公开占位值。
+const publicSessionSecret = "CHANGE_ME"
+
 func New(serviceKey string) {
 	conf.New(serviceKey, &Spec)
 	normalizeListener(&Spec.Server.GRPC)
@@ -66,16 +78,30 @@ func New(serviceKey string) {
 	if Spec.Server.GRPC.Addr == Spec.Server.HTTP.Addr {
 		panic("gRPC and HTTP listeners must use different addresses")
 	}
-	if strings.TrimSpace(Spec.Authorization.Key) == "" {
-		panic("Authorization.Key must not be empty")
+	// JWT 是全系统身份凭据，签名密钥必须由部署显式提供：优先取 BSM_JwtSecretKey 环境变量，
+	// 空值与公开样例值一律拒绝启动，避免默认配置直接上线后被用于伪造任意身份。
+	if envKey := strings.TrimSpace(os.Getenv("BSM_JwtSecretKey")); envKey != "" {
+		Spec.Authorization.Key = envKey
+	}
+	Spec.Authorization.Key = strings.TrimSpace(Spec.Authorization.Key)
+	if Spec.Authorization.Key == "" {
+		log.Fatalln("ERROR: JWT secret is not configured; provide it through the BSM_JwtSecretKey environment variable")
+	}
+	if _, isPublic := publicJwtSecretKeys[Spec.Authorization.Key]; isPublic {
+		log.Fatalln("ERROR: JWT secret is a public sample value; provide a private key through the BSM_JwtSecretKey environment variable")
 	}
 	keyLength := len(Spec.Authorization.Key)
 	if keyLength != 16 && keyLength != 24 && keyLength != 32 {
-		panic("Authorization.Key must contain 16, 24, or 32 bytes")
+		log.Fatalln("ERROR: JWT secret must contain 16, 24, or 32 bytes")
 	}
 	if Spec.Authorization.Expire <= 0 {
 		panic("Authorization.Expire must be greater than zero")
 	}
+	// session cookie 的 HMAC 密钥同样不得为空或公开占位值。
+	sessionSecret := strings.TrimSpace(Spec.SecretKey)
+	if sessionSecret == "" || sessionSecret == publicSessionSecret {
+		log.Fatalln("ERROR: SecretKey must not be empty or a public placeholder; provide a private secret through the BSM_SECRET_KEY environment variable")
+	}
 	env.NewEnv().JwtSecretKey = Spec.Authorization.Key
 	coreVars.JwtExpire = time.Duration(Spec.Authorization.Expire) * time.Second
 	// Keep the embedded base address meaningful for module configurations that

pkgs/ecmall/internal/config/config_test.go

@@ -15,12 +15,16 @@ import (
 var ecmallServices = []string{"address", "ads", "cms", "feedback", "fts", "initial", "logs", "mgt", "mall", "market", "order", "passport", "sender", "wallet"}
 
 func TestEcmallDevConfig(t *testing.T) {
+	// dev 配置中的密钥已改为环境变量占位，测试按进程实际展开后再校验结构。
+	t.Setenv("BSM_JwtSecretKey", "0123456789abcdef0123456789abcdef")
+	t.Setenv("BSM_SECRET_KEY", "0123456789abcdef0123456789abcdef")
+
 	data, err := os.ReadFile(filepath.Join("..", "..", "etc", "default_dev.yaml"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	var cfg SrvConfig
-	if err := yaml.Unmarshal(data, &cfg); err != nil {
+	if err := yaml.Unmarshal([]byte(os.ExpandEnv(string(data))), &cfg); err != nil {
 		t.Fatal(err)
 	}
 	if len(cfg.Services) == 0 {