feat: use env variable replace hardcoded hmacSecret

Author: feitianbubu

backend/domain/user/service/user_impl.go

@@ -25,6 +25,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -575,8 +576,16 @@ type Session struct {
 	ExpiresAt time.Time `json:"expires_at"` // 过期时间
 }
 
-// 用于签名的密钥（在实际应用中应从配置中读取或使用环境变量）
-var hmacSecret = []byte("opencoze-session-hmac-key")
+func initHmacSecret() []byte {
+	SESSION_SECRET := os.Getenv("SESSION_SECRET")
+	if len(SESSION_SECRET) == 0 {
+		SESSION_SECRET = "opencoze-session-hmac-key" // 默认的会话密钥
+	}
+	return []byte(SESSION_SECRET)
+}
+
+// 用于签名的密钥
+var hmacSecret = initHmacSecret()
 
 // 生成安全的会话密钥
 func generateSessionKey(sessionID int64) (string, error) {

docker/.env.example

@@ -4,6 +4,7 @@ export LOG_LEVEL="debug"
 export MAX_REQUEST_BODY_SIZE=1073741824
 export SERVER_HOST="localhost${LISTEN_ADDR}"
 export MINIO_PROXY_ENDPOINT=":8889"
+export SESSION_SECRET="opencoze-session-hmac-key"
 
 # MySQL
 export MYSQL_ROOT_PASSWORD=root