fix: 修复多个安全缺陷和功能问题

- 移除加密相关代码（服务端和所有客户端）
- 修复 JWT 验证未检查签名算法的问题
- 修复重置密码使用不安全随机数的问题
- 实现 Logout 服务端失效机制
- 修复历史版本对比 diff 颜色标记错误
- 修复占位符解析循环引用风险
- 添加用户禁用状态检查
- 更新 bug 清单文档

kenaito-conf-python-client/kenaito_conf/client.py

@@ -6,7 +6,6 @@ import requests
 
 from kenaito_conf.cache import Cache
 from kenaito_conf.config import Config
-from kenaito_conf.crypto import decrypt_config
 from kenaito_conf.listener import Listener
 
 logger = logging.getLogger("kenaito_conf")
@@ -18,8 +17,6 @@ class ConfigClient:
         self._cache = Cache(config.cache_dir)
         self._listener = Listener()
         self._configs: dict[str, str] = {}
-        self._secret: str = ""
-        self._global_secret: str = ""
         self._last_time: int = 0
         self._lock = threading.RLock()
         self._stop_event = threading.Event()
@@ -75,14 +72,6 @@ class ConfigClient:
         if data.get("code", 0) != 0:
             raise RuntimeError(f"server error: {data.get('msg', 'unknown')}")
 
-        secret = data.get("kenaito.config.encrypt-secret")
-        if secret:
-            self._secret = secret
-
-        global_secret = data.get("kenaito.config.global-encrypt-secret")
-        if global_secret:
-            self._global_secret = global_secret
-
         ts = data.get("latest.fetch.timestamp")
         if ts:
             self._last_time = int(ts)
@@ -117,8 +106,7 @@ class ConfigClient:
         if changed_data:
             changed = {}
             for k, v in changed_data.items():
-                decrypted = self._try_decrypt(v)
-                changed[k] = decrypted
+                changed[k] = v
 
             with self._lock:
                 self._configs.update(changed)
@@ -133,13 +121,7 @@ class ConfigClient:
                     continue
                 if not isinstance(v, str):
                     continue
-                self._configs[k] = self._try_decrypt(v)
-
-    def _try_decrypt(self, value: str) -> str:
-        decrypted = decrypt_config(self._secret, value)
-        if decrypted == value and self._global_secret:
-            decrypted = decrypt_config(self._global_secret, value)
-        return decrypted
+                self._configs[k] = v
 
     def _sync_loop(self) -> None:
         while not self._stop_event.is_set():

kenaito-conf-python-client/kenaito_conf/crypto.py

@@ -1,29 +0,0 @@
-import base64
-import hashlib
-
-import pyaes
-
-CRYPT_PREFIX = "{Cipher}"
-
-
-def decrypt_config(secret: str, data: str) -> str:
-    if not data.startswith(CRYPT_PREFIX):
-        return data
-    encrypted = data[len(CRYPT_PREFIX):]
-    return decrypt_with_aes(secret, encrypted)
-
-
-def decrypt_with_aes(key: str, data: str) -> str:
-    md5_hash = hashlib.md5(key.encode()).hexdigest()
-    aes_key = md5_hash[16:].encode()
-
-    cipher_text = base64.b64decode(data)
-
-    iv = b"\0" * 16
-    aes_cbc = pyaes.AESModeOfOperationCBC(aes_key, iv=iv)
-    plain_text = aes_cbc.decrypt(cipher_text)
-
-    padding = plain_text[-1]
-    plain_text = plain_text[:-padding]
-
-    return plain_text.decode()