fix: 修复多个安全缺陷和功能问题

- 移除加密相关代码（服务端和所有客户端）
- 修复 JWT 验证未检查签名算法的问题
- 修复重置密码使用不安全随机数的问题
- 实现 Logout 服务端失效机制
- 修复历史版本对比 diff 颜色标记错误
- 修复占位符解析循环引用风险
- 添加用户禁用状态检查
- 更新 bug 清单文档

kenaito-conf-php-client/src/ConfigClient.php

@@ -7,8 +7,6 @@ class ConfigClient
     private Config $config;
     private Cache $cache;
     private array $configs = [];
-    private string $secret = '';
-    private string $globalSecret = '';
     private int $lastTime = 0;
     private bool $started = false;
     private array $handlers = [];
@@ -107,12 +105,6 @@ class ConfigClient
             throw new \RuntimeException("server error: " . ($data['msg'] ?? 'unknown'));
         }
 
-        if (isset($data['kenaito.config.encrypt-secret'])) {
-            $this->secret = $data['kenaito.config.encrypt-secret'];
-        }
-        if (isset($data['kenaito.config.global-encrypt-secret'])) {
-            $this->globalSecret = $data['kenaito.config.global-encrypt-secret'];
-        }
         if (isset($data['latest.fetch.timestamp'])) {
             $this->lastTime = (int)$data['latest.fetch.timestamp'];
         }
@@ -156,7 +148,7 @@ class ConfigClient
 
         $changed = [];
         foreach ($changedData as $k => $v) {
-            $changed[$k] = $this->tryDecrypt($v);
+            $changed[$k] = $v;
         }
 
         $this->configs = array_merge($this->configs, $changed);
@@ -181,16 +173,7 @@ class ConfigClient
             if (!is_string($v)) {
                 continue;
             }
-            $this->configs[$k] = $this->tryDecrypt($v);
+            $this->configs[$k] = $v;
         }
     }
-
-    private function tryDecrypt(string $value): string
-    {
-        $decrypted = Crypto::decryptConfig($this->secret, $value);
-        if ($decrypted === $value && $this->globalSecret) {
-            $decrypted = Crypto::decryptConfig($this->globalSecret, $value);
-        }
-        return $decrypted;
-    }
 }

kenaito-conf-php-client/src/Crypto.php

@@ -1,28 +0,0 @@
-<?php
-
-namespace KenaitoConf;
-
-class Crypto
-{
-    private const CRYPT_PREFIX = '{Cipher}';
-
-    public static function decryptConfig(string $secret, string $data): string
-    {
-        if (!str_starts_with($data, self::CRYPT_PREFIX)) {
-            return $data;
-        }
-        $encrypted = substr($data, strlen(self::CRYPT_PREFIX));
-        return self::decryptWithAES($secret, $encrypted);
-    }
-
-    public static function decryptWithAES(string $key, string $data): string
-    {
-        $md5Hash = md5($key);
-        $aesKey = substr($md5Hash, 16);
-        $cipherText = base64_decode($data);
-        $iv = str_repeat("\0", 16);
-        $plainText = openssl_decrypt($cipherText, 'AES-128-CBC', $aesKey, OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING, $iv);
-        $padding = ord($plainText[strlen($plainText) - 1]);
-        return substr($plainText, 0, -$padding);
-    }
-}