|
|
import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
|
|
|
|
|
|
const TOKEN_PREFIX = "chj_";
|
|
|
const TOKEN_ALGO = "aes-256-gcm";
|
|
|
const TOKEN_IV_BYTES = 12;
|
|
|
|
|
|
function getTokenEncryptionKey(): Buffer {
|
|
|
const secret = process.env.JWT_SECRET?.trim();
|
|
|
if (!secret) {
|
|
|
throw new Error("JWT_SECRET 未配置，无法加密客户 API Key");
|
|
|
}
|
|
|
return createHash("sha256").update(secret, "utf8").digest();
|
|
|
}
|
|
|
|
|
|
export function hashServiceToken(rawToken: string): string {
|
|
|
return createHash("sha256").update(rawToken, "utf8").digest("hex");
|
|
|
}
|
|
|
|
|
|
export function generateServiceToken(): string {
|
|
|
return `${TOKEN_PREFIX}${randomBytes(24).toString("base64url")}`;
|
|
|
}
|
|
|
|
|
|
export function tokenKeyPrefix(rawToken: string): string {
|
|
|
return rawToken.slice(0, Math.min(12, rawToken.length));
|
|
|
}
|
|
|
|
|
|
export function encryptServiceToken(rawToken: string): string {
|
|
|
return encryptSecret(rawToken);
|
|
|
}
|
|
|
|
|
|
export function decryptServiceToken(ciphertext: string | null | undefined): string | null {
|
|
|
return decryptSecret(ciphertext);
|
|
|
}
|
|
|
|
|
|
/** 通用 AES-GCM 密文（API Key、承运商密码等） */
|
|
|
export function encryptSecret(plaintext: string): string {
|
|
|
const iv = randomBytes(TOKEN_IV_BYTES);
|
|
|
const cipher = createCipheriv(TOKEN_ALGO, getTokenEncryptionKey(), iv);
|
|
|
const encrypted = Buffer.concat([
|
|
|
cipher.update(plaintext, "utf8"),
|
|
|
cipher.final(),
|
|
|
]);
|
|
|
const tag = cipher.getAuthTag();
|
|
|
return Buffer.concat([iv, tag, encrypted]).toString("base64");
|
|
|
}
|
|
|
|
|
|
export function decryptSecret(ciphertext: string | null | undefined): string | null {
|
|
|
if (!ciphertext) {
|
|
|
return null;
|
|
|
}
|
|
|
const payload = Buffer.from(ciphertext, "base64");
|
|
|
if (payload.length < TOKEN_IV_BYTES + 16 + 1) {
|
|
|
return null;
|
|
|
}
|
|
|
const iv = payload.subarray(0, TOKEN_IV_BYTES);
|
|
|
const tag = payload.subarray(TOKEN_IV_BYTES, TOKEN_IV_BYTES + 16);
|
|
|
const encrypted = payload.subarray(TOKEN_IV_BYTES + 16);
|
|
|
const decipher = createDecipheriv(TOKEN_ALGO, getTokenEncryptionKey(), iv);
|
|
|
decipher.setAuthTag(tag);
|
|
|
return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(
|
|
|
"utf8",
|
|
|
);
|
|
|
}
|
