security: Đóng gói và bảo vệ khóa giải mã nội bộ trong binary, gỡ bỏ hoàn toàn khỏi cấu hình và tài liệu

config/config.go

@@ -47,8 +47,7 @@ type UpdaterConfig struct {
 }
 
 type LicenseConfig struct {
-	CryptoKey string `json:"crypto_key"` // stored as ENC(...)
-	Key       string `json:"key"`        // stored ciphertext U2FsdGVk...
+	Key string `json:"key"` // stored ciphertext U2FsdGVk...
 }
 
 type AppConfig struct {
@@ -61,7 +60,6 @@ type AppConfig struct {
 	DecryptedDBPassword    string `json:"-"`
 	DecryptedUpdaterToken  string `json:"-"`
 	DecryptedAdminPassword string `json:"-"`
-	DecryptedCryptoKey     string `json:"-"`
 }
 
 var (
@@ -162,8 +160,7 @@ func DefaultConfig() *AppConfig {
 			CurrentVersion: "v1.0.2",
 		},
 		License: LicenseConfig{
-			CryptoKey: "BAD5A05F330D5B8CDDFCA9E7ECDC840B",
-			Key:       "",
+			Key: "",
 		},
 	}
 	return cfg
@@ -182,18 +179,15 @@ func LoadConfig(path string) (*AppConfig, error) {
 		cfg.DecryptedAdminPassword = cfg.Server.AdminPassword
 		cfg.DecryptedDBPassword = cfg.Database.Password
 		cfg.DecryptedUpdaterToken = cfg.Updater.Token
-		cfg.DecryptedCryptoKey = cfg.License.CryptoKey
 
 		// Encrypt for disk save
 		encAdmin, _ := Encrypt(cfg.Server.AdminPassword)
 		encDB, _ := Encrypt(cfg.Database.Password)
 		encTok, _ := Encrypt(cfg.Updater.Token)
-		encCrypto, _ := Encrypt(cfg.License.CryptoKey)
 
 		cfg.Server.AdminPassword = encAdmin
 		cfg.Database.Password = encDB
 		cfg.Updater.Token = encTok
-		cfg.License.CryptoKey = encCrypto
 
 		data, _ := json.MarshalIndent(cfg, "", "  ")
 		_ = os.MkdirAll(filepath.Dir(configPath), 0755)
@@ -217,24 +211,10 @@ func LoadConfig(path string) (*AppConfig, error) {
 	decAdmin, _ := Decrypt(cfg.Server.AdminPassword)
 	decDB, _ := Decrypt(cfg.Database.Password)
 	decTok, _ := Decrypt(cfg.Updater.Token)
-	if cfg.License.CryptoKey == "" {
-		cfg.License.CryptoKey = "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
-	}
-	decCrypto, _ := Decrypt(cfg.License.CryptoKey)
-	if decCrypto == "" {
-		decCrypto = "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
-	}
 
 	cfg.DecryptedAdminPassword = decAdmin
 	cfg.DecryptedDBPassword = decDB
 	cfg.DecryptedUpdaterToken = decTok
-	cfg.DecryptedCryptoKey = decCrypto
-
-	// Ensure crypto key is stored encrypted on disk
-	if !strings.HasPrefix(cfg.License.CryptoKey, "ENC(") {
-		encCrypto, _ := Encrypt(cfg.License.CryptoKey)
-		cfg.License.CryptoKey = encCrypto
-	}
 
 	// Auto-migrate legacy owner & repo
 	if cfg.Updater.Owner == "" || cfg.Updater.Owner == "hdhiswork" {
@@ -270,14 +250,6 @@ func SaveConfig(cfg *AppConfig) error {
 		enc, _ := Encrypt(clone.Updater.Token)
 		clone.Updater.Token = enc
 	}
-	if clone.License.CryptoKey == "" {
-		clone.License.CryptoKey = "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
-	}
-	if !strings.HasPrefix(clone.License.CryptoKey, "ENC(") {
-		clone.DecryptedCryptoKey = clone.License.CryptoKey
-		enc, _ := Encrypt(clone.License.CryptoKey)
-		clone.License.CryptoKey = enc
-	}
 
 	data, err := json.MarshalIndent(&clone, "", "  ")
 	if err != nil {