CVE-2025-13877

@@ -13,6 +13,10 @@ import { Auth, AuthExtend } from './auth';
 import { JwtOptions, JwtService } from './base/jwt-service';
 import { ITokenBlacklistService } from './base/token-blacklist-service';
 import { ITokenControlService } from './base/token-control-service';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+
 export interface Authenticator {
   authType: string;
   options: Record<string, any>;
@@ -49,7 +53,11 @@ export class AuthManager {
 
   constructor(options: AuthManagerOptions) {
     this.options = options;
-    this.jwt = new JwtService(options.jwt);
+    const jwtOptions = options.jwt || ({} as JwtOptions);
+    if (!jwtOptions.secret) {
+      jwtOptions.secret = this.getDefaultAPIKey();
+    }
+    this.jwt = new JwtService(jwtOptions);
   }
 
   setStorer(storer: Storer) {
@@ -142,4 +150,24 @@ export class AuthManager {
       await next();
     };
   }
+
+  private getDefaultAPIKey(): Buffer | string {
+    const apiKeyPath = path.resolve(process.cwd(), 'storage', 'apps', 'main', 'api_key.dat');
+    const appKeyExists = fs.existsSync(apiKeyPath);
+    if (appKeyExists) {
+      const key = fs.readFileSync(apiKeyPath);
+      if (key.length !== 32) {
+        throw new Error('Invalid api key length in file');
+      }
+      return key;
+    }
+    const envKey = process.env.APP_KEY;
+    if (envKey && envKey !== 'your-secret-key' && envKey !== 'test-key') {
+      return envKey;
+    }
+    const key = crypto.randomBytes(32);
+    fs.mkdirSync(path.dirname(apiKeyPath), { recursive: true });
+    fs.writeFileSync(apiKeyPath, key, { mode: 0o600 });
+    return key;
+  }
 }

@@ -9,22 +9,19 @@
 
 import jwt, { JwtPayload, SignOptions } from 'jsonwebtoken';
 import { ITokenBlacklistService } from './token-blacklist-service';
+
 export interface JwtOptions {
-  secret: string;
+  secret: Buffer | string;
   expiresIn?: string;
 }
 
 export type SignPayload = Parameters<typeof jwt.sign>[0];
 
 export class JwtService {
-  constructor(
-    protected options: JwtOptions = {
-      secret: process.env.APP_KEY,
-    },
-  ) {
+  constructor(protected options: JwtOptions) {
     const { secret, expiresIn } = options;
     this.options = {
-      secret: secret || process.env.APP_KEY,
+      secret,
       expiresIn: expiresIn || process.env.JWT_EXPIRES_IN || '7d',
     };
   }

@@ -124,7 +124,7 @@ export class MockServer extends Application {
   agent(callback?): ExtendedAgent {
     const agent = supertest.agent(callback || this.callback());
     const prefix = this.resourcer.options.prefix;
-    const authManager = this.authManager;
+    const authManager = this.authManager as any;
     const proxy = new Proxy(agent, {
       get(target, method: string, receiver) {
         if (['login', 'loginUsingId'].includes(method)) {
@@ -142,7 +142,7 @@ export class MockServer extends Application {
                     roleName,
                     signInTime: Date.now(),
                   },
-                  process.env.APP_KEY,
+                  authManager.jwt.secret(),
                   {
                     jwtid: tokenInfo.jti,
                     expiresIn,

@@ -10,7 +10,6 @@
 import Database, { BelongsToManyRepository } from '@nocobase/database';
 import UsersPlugin from '@nocobase/plugin-users';
 import { createMockServer, MockServer } from '@nocobase/test';
-import jwt from 'jsonwebtoken';
 import { SystemRoleMode } from '../enum';
 import { UNION_ROLE_KEY } from '../constants';
 
@@ -146,7 +145,7 @@ describe('role', () => {
     await userRolesRepo.add('test1');
     await userRolesRepo.add('test2');
 
-    const userToken = jwt.sign({ userId: user.get('id') }, 'test-key');
+    const userToken = api.authManager.jwt.sign({ userId: user.get('id') });
     const response = await api
       .agent()
       .post('/users:setDefaultRole')
@@ -188,7 +187,7 @@ describe('role', () => {
         roleMode: SystemRoleMode.allowUseUnion,
       },
     });
-    const userToken = jwt.sign({ userId: user.get('id') }, 'test-key');
+    const userToken = api.authManager.jwt.sign({ userId: user.get('id') });
     const response = await api
       .agent()
       .post('/users:setDefaultRole')

@@ -625,16 +625,10 @@ describe('workflow > instructions > request', () => {
     it('request db resource', async () => {
       const user = await db.getRepository('users').create({});
 
-      const token = jwt.sign(
-        {
-          userId: user.id,
-          signInTime: Date.now(),
-        },
-        process.env.APP_KEY,
-        {
-          expiresIn: '1d',
-        },
-      );
+      const token = app.authManager.jwt.sign({
+        userId: user.id,
+        signInTime: Date.now(),
+      });
 
       const server = app.listen(0, () => {});