42 lines
1.5 KiB
JavaScript
42 lines
1.5 KiB
JavaScript
#!/usr/bin/env node
|
||
'use strict';
|
||
|
||
/**
|
||
* 生成 JWT 用 Ed25519 密钥对（PEM）。
|
||
* 用法：node scripts/generate-jwt-keys.js [--force]
|
||
* 输出目录默认：apps/server/keys/（已 gitignore）
|
||
*/
|
||
const fs = require('fs');
|
||
const path = require('path');
|
||
const { generateKeyPairSync } = require('crypto');
|
||
const { DEFAULT_DIR, DEFAULT_PRIVATE, DEFAULT_PUBLIC } = require('../src/auth/jwt-keys');
|
||
|
||
const force = process.argv.includes('--force');
|
||
|
||
function main() {
|
||
if (!force && (fs.existsSync(DEFAULT_PRIVATE) || fs.existsSync(DEFAULT_PUBLIC))) {
|
||
console.error('密钥已存在。若要覆盖请加 --force');
|
||
console.error(` private: ${DEFAULT_PRIVATE}`);
|
||
console.error(` public: ${DEFAULT_PUBLIC}`);
|
||
process.exit(1);
|
||
}
|
||
|
||
fs.mkdirSync(DEFAULT_DIR, { recursive: true, mode: 0o700 });
|
||
const { privateKey, publicKey } = generateKeyPairSync('ed25519');
|
||
const privPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
|
||
const pubPem = publicKey.export({ type: 'spki', format: 'pem' });
|
||
|
||
fs.writeFileSync(DEFAULT_PRIVATE, privPem, { mode: 0o600 });
|
||
fs.writeFileSync(DEFAULT_PUBLIC, pubPem, { mode: 0o644 });
|
||
|
||
console.log('已生成 Ed25519 JWT 密钥对：');
|
||
console.log(` private: ${DEFAULT_PRIVATE} (mode 600)`);
|
||
console.log(` public: ${DEFAULT_PUBLIC}`);
|
||
console.log('可选 .env：');
|
||
console.log(` JWT_PRIVATE_KEY_PATH=${DEFAULT_PRIVATE}`);
|
||
console.log(` JWT_PUBLIC_KEY_PATH=${DEFAULT_PUBLIC}`);
|
||
console.log(' JWT_KEY_ID=ed25519-1');
|
||
}
|
||
|
||
main();
|