Fix25.1: стабилизирован auth_id flow и unlimited-семантика, усилен bootstrap secrets

apps/dao/sqlite.go

@@ -63,6 +63,9 @@ func InitSql(port string) error {
 	if err := ensureSecureBootstrapAdmin(); err != nil {
 		return err
 	}
+	if _, err := getOrCreateJwtSecret(); err != nil {
+		return err
+	}
 	if err := ensureTrafficStatsSecret(); err != nil {
 		return err
 	}
@@ -337,7 +340,11 @@ func migrateLegacyAccounts() error {
 		if authErr != nil {
 			return authErr
 		}
-		secretDigest := util.PeerSecretDigest(*acc.ConPass)
+		peerSecretKey, keyErr := getOrCreatePeerSecretDigestKey()
+		if keyErr != nil {
+			return keyErr
+		}
+		secretDigest := util.HmacSHA256Hex(*acc.ConPass, peerSecretKey)
 		secretEncrypted := *acc.ConPass
 		quota := int64(0)
 		if acc.Quota != nil {
@@ -397,6 +404,46 @@ func migrateLegacyAccounts() error {
 	return nil
 }
 
+func getOrCreateJwtSecret() (string, error) {
+	if existing, err := GetConfig("key = ?", constant.JwtSecret); err == nil {
+		if existing.Value != nil && strings.TrimSpace(*existing.Value) != "" {
+			return strings.TrimSpace(*existing.Value), nil
+		}
+	}
+	secret, secErr := util.RandomString(64)
+	if secErr != nil {
+		return "", secErr
+	}
+	if err := UpdateConfig([]string{constant.JwtSecret}, map[string]interface{}{"value": secret}); err != nil {
+		key := constant.JwtSecret
+		remark := "JWT signing secret"
+		if _, saveErr := SaveConfig(entity.Config{Key: &key, Value: &secret, Remark: &remark}); saveErr != nil {
+			return "", saveErr
+		}
+	}
+	return secret, nil
+}
+
+func getOrCreatePeerSecretDigestKey() (string, error) {
+	if existing, err := GetConfig("key = ?", constant.PeerSecretKey); err == nil {
+		if existing.Value != nil && strings.TrimSpace(*existing.Value) != "" {
+			return strings.TrimSpace(*existing.Value), nil
+		}
+	}
+	keyValue, keyErr := util.RandomString(48)
+	if keyErr != nil {
+		return "", keyErr
+	}
+	if err := UpdateConfig([]string{constant.PeerSecretKey}, map[string]interface{}{"value": keyValue}); err != nil {
+		key := constant.PeerSecretKey
+		remark := "Peer secret digest key"
+		if _, saveErr := SaveConfig(entity.Config{Key: &key, Value: &keyValue, Remark: &remark}); saveErr != nil {
+			return "", saveErr
+		}
+	}
+	return keyValue, nil
+}
+
 func archiveLegacyAccount() error {
 	if !tableExists("account") {
 		return nil
@@ -517,7 +564,7 @@ func ensureTrafficStatsSecret() error {
 	envSecret := strings.TrimSpace(os.Getenv("HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET"))
 	if envSecret != "" {
 		if existing, err := GetConfig("key = ?", constant.Hysteria2TrafficStatsSecret); err == nil {
-			if existing.Value != nil && *existing.Value != envSecret {
+			if existing.Value != nil && strings.TrimSpace(*existing.Value) != envSecret {
 				return UpdateConfig([]string{constant.Hysteria2TrafficStatsSecret}, map[string]interface{}{"value": envSecret})
 			}
 			return nil
@@ -530,8 +577,10 @@ func ensureTrafficStatsSecret() error {
 		return nil
 	}
 
-	if _, err := GetConfig("key = ?", constant.Hysteria2TrafficStatsSecret); err == nil {
-		return nil
+	if existing, err := GetConfig("key = ?", constant.Hysteria2TrafficStatsSecret); err == nil {
+		if existing.Value != nil && strings.TrimSpace(*existing.Value) != "" {
+			return nil
+		}
 	}
 	secret, secErr := util.RandomString(32)
 	if secErr != nil {