chore: import verified syly2 maintenance baseline without embedded credentials

2026-10-29 22:22:49 +08:00
commit da8224efd8
5265 changed files with 1199963 additions and 0 deletions
@@ -0,0 +1,49 @@
+import com.zzc.core.util.EncryptionUtil;
+import com.zzc.core.util.RsaUtils;
+import com.zzc.core.util.RuntimeSecrets;
+import cn.hutool.crypto.asymmetric.KeyType;
+import cn.hutool.crypto.asymmetric.RSA;
+import cn.hutool.crypto.SecureUtil;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+/** Offline checks; the caller supplies test keys in a private temporary file. */
+public class SecretsCheck {
+    private static void check(boolean result, String message) {
+        if (!result) throw new AssertionError(message);
+    }
+
+    public static void main(String[] args) {
+        if (args.length > 0 && args[0].equals("config")) {
+            check(args[1].equals(RuntimeSecrets.required("SYLY_CONFIG_TEST")), "Configuration source/precedence");
+            System.out.println("Private-file/environment configuration checks passed");
+            return;
+        }
+        if (args.length > 0 && args[0].equals("missing")) {
+            try {
+                RuntimeSecrets.required("SYLY_MISSING_TEST_SECRET");
+                throw new AssertionError("Missing secrets must fail");
+            } catch (IllegalStateException expected) {
+                check(!expected.getMessage().contains("test-secret-value"), "Value leaked");
+            }
+            check(RuntimeSecrets.optional("SYLY_MISSING_TEST_SECRET").isEmpty(), "Optional default");
+            System.out.println("Missing-secret checks passed");
+            return;
+        }
+        String plain = "offline-check-中文-2026";
+        String encrypted = EncryptionUtil.encrypt(plain);
+        check(!plain.equals(encrypted), "AES must encrypt");
+        check(plain.equals(EncryptionUtil.decrypt(encrypted)), "AES round trip");
+        String raw = SecureUtil.aes(Base64.getDecoder().decode(RuntimeSecrets.required("SYLY_AES_KEY"))).encryptBase64(plain);
+        check(encrypted.substring(8).equals(raw), "AES format changed");
+        check(plain.equals(EncryptionUtil.decrypt(raw)), "Legacy ciphertext without prefix");
+        check(EncryptionUtil.encrypt(null) == null, "Null input");
+        check("".equals(EncryptionUtil.decrypt("")), "Empty input");
+        check(plain.equals(EncryptionUtil.decrypt(plain)), "Plaintext compatibility");
+        String rsaCipher = RsaUtils.getInstance().encrypt(plain);
+        check(plain.equals(RsaUtils.decrypt(rsaCipher)), "RSA round trip with retained public key");
+        RSA independent = new RSA(RuntimeSecrets.required("SYLY_RSA_PRIVATE_KEY"), RsaUtils.getPublicKey());
+        check(plain.equals(new String(independent.decrypt(Base64.getDecoder().decode(rsaCipher), KeyType.PrivateKey), StandardCharsets.UTF_8)), "RSA compatibility");
+        System.out.println("AES/RSA offline compatibility checks passed");
+    }
+}