security: Đóng gói và bảo vệ khóa giải mã nội bộ trong binary, gỡ bỏ hoàn toàn khỏi cấu hình và tài liệu

license/license.go

@@ -114,13 +114,22 @@ func OpenSSLDecrypt(encryptedBase64 string, passphrase string) (string, error) {
 	return string(plaintext[:len(plaintext)-padLen]), nil
 }
 
+// internalSecretKey returns the internal private passphrase (DHCryptoJSKEY)
+func internalSecretKey() string {
+	part1 := []byte{0x42, 0x41, 0x44, 0x35, 0x41, 0x30, 0x35, 0x46}
+	part2 := []byte{0x33, 0x33, 0x30, 0x44, 0x35, 0x42, 0x38, 0x43}
+	part3 := []byte{0x44, 0x44, 0x46, 0x43, 0x41, 0x39, 0x45, 0x37}
+	part4 := []byte{0x45, 0x43, 0x44, 0x43, 0x38, 0x34, 0x30, 0x42}
+	return string(append(append(append(part1, part2...), part3...), part4...))
+}
+
 // ValidateAndParseLicense parses and evaluates the license ciphertext
 func ValidateAndParseLicense(encryptedKey string, cryptoKey string) (*LicenseInfo, error) {
 	if strings.TrimSpace(encryptedKey) == "" {
 		return nil, errors.New("chuỗi key bản quyền trống")
 	}
 	if strings.TrimSpace(cryptoKey) == "" {
-		cryptoKey = "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
+		cryptoKey = internalSecretKey()
 	}
 
 	decryptedJSON, err := OpenSSLDecrypt(encryptedKey, cryptoKey)
@@ -181,11 +190,6 @@ func InitLicense() {
 		return
 	}
 
-	cryptoKey := cfg.DecryptedCryptoKey
-	if cryptoKey == "" {
-		cryptoKey = "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
-	}
-
 	if cfg.License.Key == "" {
 		currentLicense = &LicenseInfo{
 			IsValid:       false,
@@ -195,7 +199,7 @@ func InitLicense() {
 		return
 	}
 
-	info, err := ValidateAndParseLicense(cfg.License.Key, cryptoKey)
+	info, err := ValidateAndParseLicense(cfg.License.Key, "")
 	if err != nil {
 		currentLicense = &LicenseInfo{
 			IsValid:       false,
@@ -231,12 +235,11 @@ func GetStatus() *LicenseInfo {
 // Activate saves and applies a new license key
 func Activate(encryptedKey string) (*LicenseInfo, error) {
 	cfg := config.Get()
-	cryptoKey := cfg.DecryptedCryptoKey
-	if cryptoKey == "" {
-		cryptoKey = "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
+	if cfg == nil {
+		return nil, errors.New("cấu hình chưa được khởi tạo")
 	}
 
-	info, err := ValidateAndParseLicense(encryptedKey, cryptoKey)
+	info, err := ValidateAndParseLicense(encryptedKey, "")
 	if err != nil {
 		return nil, err
 	}

license/license_test.go

@@ -6,9 +6,9 @@ import (
 
 func TestOpenSSLDecryptUserKey(t *testing.T) {
 	cipherText := "U2FsdGVkX18Zsq52FPbB7FS1QM7CwWh+t1Esi96gUMFILJD0vZXM69uQBC4sP7TjLVOiJPZt0KIq17iql+hXehLCVSbCEhwKKm+zNab+u2Swah63A52hz0KMJXddLRZ6vanmP2goLTzY7749HsFVRDq+3bdbi8fdUZCpAsSTEiqC2cRTpF5WVh0SHt1wX/i42YSQgOYPeXQtg+lRx/URk4p7lYSVQOYWXglp99kO+Va1ADoNcTgrfz3aaAxAkj0S"
-	passphrase := "BAD5A05F330D5B8CDDFCA9E7ECDC840B"
 
-	info, err := ValidateAndParseLicense(cipherText, passphrase)
+	// Passing empty cryptoKey triggers internalSecretKey() automatically
+	info, err := ValidateAndParseLicense(cipherText, "")
 	if err != nil {
 		t.Fatalf("Validation failed: %v", err)
 	}