85 lines
2.1 KiB
Go
85 lines
2.1 KiB
Go
package service
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"errors"
|
|
"strings"
|
|
|
|
"hy2xs-admin/dao"
|
|
"hy2xs-admin/model/constant"
|
|
"hy2xs-admin/model/entity"
|
|
"hy2xs-admin/util"
|
|
)
|
|
|
|
func getOrCreateConfigKey(key string, size int) (string, error) {
|
|
cfg, err := dao.GetConfig("key = ?", key)
|
|
if err == nil && cfg.Value != nil && strings.TrimSpace(*cfg.Value) != "" {
|
|
return strings.TrimSpace(*cfg.Value), nil
|
|
}
|
|
raw, genErr := util.RandomString(size)
|
|
if genErr != nil {
|
|
return "", genErr
|
|
}
|
|
value := raw
|
|
remark := key
|
|
if _, saveErr := dao.SaveConfig(entity.Config{Key: &key, Value: &value, Remark: &remark}); saveErr != nil {
|
|
if updErr := dao.UpdateConfig([]string{key}, map[string]interface{}{"value": value}); updErr != nil {
|
|
return "", updErr
|
|
}
|
|
}
|
|
return value, nil
|
|
}
|
|
|
|
func GetPeerSecretKey() (string, error) {
|
|
return getOrCreateConfigKey(constant.PeerSecretKey, 48)
|
|
}
|
|
|
|
func getPeerSecretEncryptionKey() ([]byte, error) {
|
|
raw, err := getOrCreateConfigKey(constant.PeerSecretEncryptionKey, 32)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
decoded, decErr := util.DecodeBase64Key(raw, 32)
|
|
if decErr == nil {
|
|
return decoded, nil
|
|
}
|
|
// legacy/plain bootstrap path: convert to stable base64 once
|
|
plain := []byte(strings.TrimSpace(raw))
|
|
if len(plain) < 32 {
|
|
return nil, errors.New("invalid peer secret encryption key")
|
|
}
|
|
plain = plain[:32]
|
|
encoded := base64.StdEncoding.EncodeToString(plain)
|
|
if updErr := dao.UpdateConfig([]string{constant.PeerSecretEncryptionKey}, map[string]interface{}{"value": encoded}); updErr != nil {
|
|
return nil, updErr
|
|
}
|
|
return plain, nil
|
|
}
|
|
|
|
func PeerSecretDigest(rawSecret string) (string, error) {
|
|
secretKey, err := GetPeerSecretKey()
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return util.HmacSHA256Hex(rawSecret, secretKey), nil
|
|
}
|
|
|
|
func EncryptPeerSecret(rawSecret string) (string, error) {
|
|
key, err := getPeerSecretEncryptionKey()
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return util.EncryptAESGCM(rawSecret, key)
|
|
}
|
|
|
|
func DecryptPeerSecret(stored string) (string, error) {
|
|
if !strings.HasPrefix(stored, "v1:") {
|
|
return stored, nil
|
|
}
|
|
key, err := getPeerSecretEncryptionKey()
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return util.DecryptAESGCM(stored, key)
|
|
}
|