fix: save llm key without extra secret

2026-08-22 22:25:07 +08:00
parent f8f0b3c4fd
commit acf6356ba6
4 changed files with 14 additions and 25 deletions
@@ -65,13 +65,11 @@ public sealed class LlmSecretProtector(IConfiguration configuration)

    private byte[] ReadEncryptionKey()
    {
-        var raw = configuration["Secrets:EncryptionKey"];
-        byte[]? key = null;
-        try { key = string.IsNullOrWhiteSpace(raw) ? null : Convert.FromBase64String(raw); }
-        catch (FormatException) { }
-        if (key?.Length != 32)
-            throw new InvalidOperationException(
-                "请通过 Secrets__EncryptionKey 配置 base64 编码的 32 字节密钥后再保存 API Key");
-        return key;
+        var jwtSecret = configuration["Jwt:Secret"];
+        if (string.IsNullOrWhiteSpace(jwtSecret) || jwtSecret.Length < 32)
+            throw new InvalidOperationException("服务端 JWT 密钥配置无效，无法保护 API Key");
+        return HMACSHA256.HashData(
+            Encoding.UTF8.GetBytes(jwtSecret),
+            Encoding.UTF8.GetBytes("jizhi:llm-api-key-encryption:v1"));
    }
 }