From 8bac8cef07f9c2f89e8ab647790614f62ee17cde Mon Sep 17 00:00:00 2001
From: Administrator <admin@example.com>
Date: Mon, 25 May 2026 09:15:09 +0800
Subject: [PATCH] feat: add RSA key generation script for deployment

---
 script/generate-keys.sh | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100755 script/generate-keys.sh

diff --git a/script/generate-keys.sh b/script/generate-keys.sh
new file mode 100755
index 0000000..c411713
--- /dev/null
+++ b/script/generate-keys.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+# Generate matching RSA key pair for OpenTCS Plus encryption
+# Usage: ./script/generate-keys.sh
+# Output: matching keys for backend application.yml and frontend .env.production
+
+echo "=== Generating RSA 512-bit key pair ==="
+
+# Generate private key in PKCS#8 format
+openssl genrsa 512 | openssl pkcs8 -topk8 -inform pem -outform pem -nocrypt -out /tmp/private_key.pem 2>/dev/null
+
+# Extract private key as single-line base64 (PKCS#8 format)
+PRIVATE_KEY=$(openssl pkcs8 -topk8 -inform pem -outform der -nocrypt -in /tmp/private_key.pem 2>/dev/null | base64 -w0)
+
+# Extract public key as single-line base64 (X.509 SPKI format)
+PUBLIC_KEY=$(openssl rsa -in /tmp/private_key.pem -pubout -outform der 2>/dev/null | base64 -w0)
+
+echo ""
+echo "=== Backend (application.yml) ==="
+echo "api-decrypt:"
+echo "  publicKey: ${PUBLIC_KEY}    # 响应加密公钥"
+echo "  privateKey: ${PRIVATE_KEY}  # 请求解密私钥"
+echo ""
+echo "=== Frontend (.env.production) ==="
+echo "VITE_APP_RSA_PUBLIC_KEY=${PUBLIC_KEY}   # 请求加密公钥（与后端 privateKey 配对）"
+echo "VITE_APP_RSA_PRIVATE_KEY=${PRIVATE_KEY}  # 响应解密私钥（与后端 publicKey 配对）"
+
+rm -f /tmp/private_key.pem