Claude Code调用Figma API时如何安全注入Token避免泄露？

🔐 安全Token管理策略

在Claude Code与Figma MCP集成中，API Token的安全管理至关重要。以下是几种安全注入Token的方案对比：

📁 方案一：环境变量配置（推荐）

1.1 系统级环境变量设置

macOS/Linux：

# 编辑shell配置文件
nano ~/.zshrc  # 或 ~/.bashrc、~/.bash_profile

# 添加环境变量
export FIGMA_TOKEN="figd_你的个人访问令牌"
export CLAUDE_MCP_CONFIG_PATH="$HOME/.config/claude"

# 使配置生效
source ~/.zshrc

# 验证环境变量
echo $FIGMA_TOKEN

Windows：

# PowerShell设置永久环境变量
[System.Environment]::SetEnvironmentVariable('FIGMA_TOKEN', 'figd_你的个人访问令牌', [System.EnvironmentVariableTarget]::User)

# 或使用图形界面
# 1. 右键"此电脑" → 属性 → 高级系统设置
# 2. 环境变量 → 新建用户变量
# 3. 变量名：FIGMA_TOKEN，变量值：你的Token

1.2 Claude Code配置文件引用环境变量

// ~/.config/claude/mcp-settings.json
{
  "mcpServers": {
    "figma": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-figma"
      ],
      "env": {
        "FIGMA_PERSONAL_ACCESS_TOKEN": "${FIGMA_TOKEN}"
      }
    }
  }
}

安全优势：

• Token不存储在代码仓库中
• 每个开发者可独立配置
• 便于CI/CD流水线集成

🔒 方案二：加密配置文件

2.1 使用加密工具保护Token

// token-encryptor.js - Token加密工具 
const crypto = require('crypto');
const fs = require('fs');

class TokenEncryptor {
  constructor() {
    // 从环境变量获取加密密钥
    this.encryptionKey = process.env.ENCRYPTION_KEY || this.generateKey();
  }
  
  /**
   * 生成随机加密密钥
   */
  generateKey() {
    return crypto.randomBytes(32).toString('hex');
  }
  
  /**
   * 加密Token
   * @param {string} token - Figma API Token
   * @returns {string} 加密后的Token
   */
  encryptToken(token) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv(
      'aes-256-gcm',
      Buffer.from(this.encryptionKey, 'hex'),
      iv
    );
    
    let encrypted = cipher.update(token, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    
    const authTag = cipher.getAuthTag().toString('hex');
    
    return {
      iv: iv.toString('hex'),
      encryptedToken: encrypted,
      authTag: authTag
    };
  }
  
  /**
   * 解密Token
   * @param {Object} encryptedData - 加密数据
   * @returns {string} 解密后的Token
   */
  decryptToken(encryptedData) {
    const decipher = crypto.createDecipheriv(
      'aes-256-gcm',
      Buffer.from(this.encryptionKey, 'hex'),
      Buffer.from(encryptedData.iv, 'hex')
    );
    
    decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'hex'));
    
    let decrypted = decipher.update(
      encryptedData.encryptedToken,
      'hex',
      'utf8'
    );
    decrypted += decipher.final('utf8');
    
    return decrypted;
  }
  
  /**
   * 保存加密配置
   */
  saveEncryptedConfig() {
    const token = process.env.FIGMA_TOKEN;
    if (!token) {
      throw new Error('FIGMA_TOKEN环境变量未设置');
    }
    
    const encrypted = this.encryptToken(token);
    const config = {
      encryptedToken: encrypted,
      encryptionKey: this.encryptionKey,
      timestamp: new Date().toISOString()
    };
    
    fs.writeFileSync(
      'figma-token.encrypted.json',
      JSON.stringify(config, null, 2)
    );
    
    console.log('✅ Token已加密保存到 figma-token.encrypted.json');
    console.log('⚠️ 请妥善保管 encryptionKey:', this.encryptionKey);
  }
}

// 使用示例
const encryptor = new TokenEncryptor();
encryptor.saveEncryptedConfig();

2.2 解密并加载Token

// token-loader.js - Token加载器
const crypto = require('crypto');
const fs = require('fs');

class TokenLoader {
  constructor(encryptionKey) {
    this.encryptionKey = encryptionKey;
  }
  
  loadAndDecrypt() {
    try {
      const config = JSON.parse(
        fs.readFileSync('figma-token.encrypted.json', 'utf8')
      );
      
      const decipher = crypto.createDecipheriv(
        'aes-256-gcm',
        Buffer.from(this.encryptionKey, 'hex'),
        Buffer.from(config.encryptedToken.iv, 'hex')
      );
      
      decipher.setAuthTag(
        Buffer.from(config.encryptedToken.authTag, 'hex')
      );
      
      let decrypted = decipher.update(
        config.encryptedToken.encryptedToken,
        'hex',
        'utf8'
      );
      decrypted += decipher.final('utf8');
      
      // 设置为环境变量
      process.env.FIGMA_TOKEN = decrypted;
      
      console.log('✅ Token解密成功');
      return decrypted;
    } catch (error) {
      console.error('❌ Token解密失败:', error.message);
      return null;
    }
  }
}

// 在Claude MCP配置前调用
const loader = new TokenLoader(process.env.ENCRYPTION_KEY);
loader.loadAndDecrypt();

🏢 方案三：企业级密钥管理

3.1 AWS Secrets Manager集成

// aws-secrets-loader.js - AWS密钥管理集成 
const { SecretsManagerClient, GetSecretValueCommand } = require('@aws-sdk/client-secrets-manager');

class AWSSecretsManager {
  constructor() {
    this.client = new SecretsManagerClient({
      region: process.env.AWS_REGION || 'us-east-1'
    });
  }
  
  /**
   * 从AWS Secrets Manager获取Figma Token
   */
  async getFigmaToken() {
    try {
      const command = new GetSecretValueCommand({
        SecretId: 'claude-figma-token',
        VersionStage: 'AWSCURRENT'
      });
      
      const response = await this.client.send(command);
      
      if (response.SecretString) {
        const secret = JSON.parse(response.SecretString);
        return secret.FIGMA_TOKEN;
      }
      
      return null;
    } catch (error) {
      console.error('❌ AWS Secrets Manager获取失败:', error);
      return null;
    }
  }
  
  /**
   * 自动更新环境变量
   */
  async setupEnvironment() {
    const token = await this.getFigmaToken();
    if (token) {
      process.env.FIGMA_TOKEN = token;
      console.log('✅ Figma Token已从AWS Secrets Manager加载');
      return true;
    }
    return false;
  }
}

// 在应用启动时调用
const secretsManager = new AWSSecretsManager();
await secretsManager.setupEnvironment();

3.2 HashiCorp Vault集成

// vault-integration.js - Vault集成方案
const axios = require('axios');

class VaultIntegration {
  constructor(vaultUrl, roleId, secretId) {
    this.vaultUrl = vaultUrl;
    this.roleId = roleId;
    this.secretId = secretId;
    this.token = null;
  }
  
  /**
   * 获取Vault认证令牌
   */
  async authenticate() {
    try {
      const response = await axios.post(
        `${this.vaultUrl}/v1/auth/approle/login`,
        {
          role_id: this.roleId,
          secret_id: this.secretId
        }
      );
      
      this.token = response.data.auth.client_token;
      return true;
    } catch (error) {
      console.error('❌ Vault认证失败:', error.message);
      return false;
    }
  }
  
  /**
   * 从Vault获取密钥
   */
  async getSecret(path) {
    if (!this.token) {
      await this.authenticate();
    }
    
    try {
      const response = await axios.get(
        `${this.vaultUrl}/v1/secret/data/${path}`,
        {
          headers: {
            'X-Vault-Token': this.token
          }
        }
      );
      
      return response.data.data.data;
    } catch (error) {
      console.error('❌ 获取密钥失败:', error.message);
      return null;
    }
  }
  
  /**
   * 加载Figma Token
   */
  async loadFigmaToken() {
    const secrets = await this.getSecret('claude/figma');
    if (secrets && secrets.token) {
      process.env.FIGMA_TOKEN = secrets.token;
      console.log('✅ Figma Token已从Vault加载');
      return secrets.token;
    }
    return null;
  }
}

// 使用示例
const vault = new VaultIntegration(
  process.env.VAULT_ADDR,
  process.env.VAULT_ROLE_ID,
  process.env.VAULT_SECRET_ID
);

await vault.loadFigmaToken();

🛡️ 方案四：临时Token与访问控制

4.1 Figma Token权限最小化

// token-permission-manager.js - Token权限管理
class TokenPermissionManager {
  /**
   * 生成最小权限Token请求
   */
  static getMinimalTokenScopes() {
    return {
      // 仅读取文件内容权限
      scopes: ['files:read'],
      // Token有效期（秒）
      expires_in: 3600, // 1小时
      // 描述用途
      description: 'Claude MCP Integration - Read Only',
      // 限制访问的文件ID
      file_ids: ['specific-file-id-here'] // 可选，限制特定文件
    };
  }
  
  /**
   * 验证Token权限
   */
  static validateTokenPermissions(tokenInfo) {
    const requiredScopes = ['files:read'];
    const tokenScopes = tokenInfo.scopes || [];
    
    // 检查是否包含必要权限
    const hasRequiredScopes = requiredScopes.every(scope => 
      tokenScopes.includes(scope)
    );
    
    // 检查是否有过多权限
    const hasExcessivePermissions = tokenScopes.some(scope => 
      !requiredScopes.includes(scope)
    );
    
    return {
      isValid: hasRequiredScopes,
      hasExcessivePermissions,
      missingScopes: requiredScopes.filter(scope => 
        !tokenScopes.includes(scope)
      ),
      excessiveScopes: tokenScopes.filter(scope => 
        !requiredScopes.includes(scope)
      )
    };
  }
  
  /**
   * 生成Token使用报告
   */
  static generateTokenReport(tokenInfo) {
    const validation = this.validateTokenPermissions(tokenInfo);
    
    return {
      timestamp: new Date().toISOString(),
      tokenId: tokenInfo.id || 'unknown',
      scopes: tokenInfo.scopes,
      validation: {
        status: validation.isValid ? 'PASS' : 'FAIL',
        issues: validation.missingScopes.length > 0 ? 
          `缺少权限: ${validation.missingScopes.join(', ')}` : 
          validation.hasExcessivePermissions ? 
          `权限过多: ${validation.excessiveScopes.join(', ')}` : 
          '权限配置正确'
      },
      recommendations: validation.hasExcessivePermissions ? 
        '建议重新生成仅包含files:read权限的Token' : 
        '权限配置符合最小权限原则'
    };
  }
}

// 使用示例
const tokenInfo = {
  id: 'tok_abc123',
  scopes: ['files:read', 'files:write'], // 示例：包含过多权限
  created_at: '2024-01-01T00:00:00Z'
};

const report = TokenPermissionManager.generateTokenReport(tokenInfo);
console.log('Token权限报告:', JSON.stringify(report, null, 2));

4.2 Token自动轮换策略

// token-rotator.js - Token自动轮换
const cron = require('node-cron');
const axios = require('axios');

class TokenRotator {
  constructor(figmaApiKey, figmaApiSecret) {
    this.figmaApiKey = figmaApiKey;
    this.figmaApiSecret = figmaApiSecret;
    this.currentToken = null;
    this.tokenExpiry = null;
  }
  
  /**
   * 生成新Token
   */
  async generateNewToken() {
    try {
      const response = await axios.post(
        'https://api.figma.com/v1/oauth/token',
        {
          client_id: this.figmaApiKey,
          client_secret: this.figmaApiSecret,
          grant_type: 'client_credentials',
          scope: 'files:read'
        },
        {
          headers: {
            'Content-Type': 'application/json'
          }
        }
      );
      
      this.currentToken = response.data.access_token;
      this.tokenExpiry = new Date(Date.now() + response.data.expires_in * 1000);
      
      // 更新环境变量
      process.env.FIGMA_TOKEN = this.currentToken;
      
      console.log(`✅ 新Token已生成，有效期至: ${this.tokenExpiry.toISOString()}`);
      
      return this.currentToken;
    } catch (error) {
      console.error('❌ Token生成失败:', error.message);
      return null;
    }
  }
  
  /**
   * 检查Token是否即将过期
   */
  isTokenExpiringSoon() {
    if (!this.tokenExpiry) return true;
    
    const now = new Date();
    const oneHour = 60 * 60 * 1000; // 1小时
    return this.tokenExpiry.getTime() - now.getTime() < oneHour;
  }
  
  /**
   * 启动自动轮换
   */
  startAutoRotation() {
    // 每小时检查一次
    cron.schedule('0 * * * *', async () => {
      if (this.isTokenExpiringSoon()) {
        console.log('🔄 Token即将过期，开始轮换...');
        await this.generateNewToken();
      }
    });
    
    // 初始生成Token
    this.generateNewToken().then(() => {
      console.log('✅ Token自动轮换服务已启动');
    });
  }
  
  /**
   * 获取当前Token
   */
  getCurrentToken() {
    return this.currentToken;
  }
}

// 使用示例
const rotator = new TokenRotator(
  process.env.FIGMA_CLIENT_ID,
  process.env.FIGMA_CLIENT_SECRET
);

rotator.startAutoRotation();

📋 安全最佳实践清单

5.1 开发环境配置

# .env.example - 环境变量示例模板
# 复制此文件为 .env 并填写实际值
FIGMA_TOKEN=your_figma_personal_access_token_here
ENCRYPTION_KEY=your_encryption_key_here  # 可选，用于本地加密
VAULT_ADDR=https://vault.yourcompany.com  # 可选，企业级
AWS_REGION=us-east-1  # 可选，AWS用户

# Git忽略配置
# .gitignore
.env
*.encrypted.json
secrets/
config/local*.json

5.2 代码审查安全检查

// security-audit.js - 安全审计脚本
const fs = require('fs');
const path = require('path');

class SecurityAudit {
  /**
   * 检查配置文件中的敏感信息
   */
  static auditConfigurationFiles() {
    const sensitivePatterns = [
      /figd_[a-zA-Z0-9_-]{64}/, // Figma Token格式
      /sk-[a-zA-Z0-9]{48}/, // OpenAI格式
      /ghp_[a-zA-Z0-9]{36}/, // GitHub格式
      /"token"\s*:\s*"[^"]+"/, // JSON中的token
      /api[_-]?key/i,
      /secret/i,
      /password/i
    ];
    
    const filesToCheck = [
      'mcp-settings.json',
      'package.json',
      '*.config.js',
      '*.config.ts'
    ];
    
    let issues = [];
    
    filesToCheck.forEach(filePattern => {
      const files = this.findFiles(filePattern);
      
      files.forEach(file => {
        const content = fs.readFileSync(file, 'utf8');
        
        sensitivePatterns.forEach(pattern => {
          if (pattern.test(content)) {
            issues.push({
              file: file,
              pattern: pattern.toString(),
              severity: 'HIGH',
              recommendation: '将敏感信息移至环境变量或密钥管理服务'
            });
          }
        });
      });
    });
    
    return issues;
  }
  
  /**
   * 查找文件
   */
  static findFiles(pattern) {
    // 简化实现，实际应使用glob等库
    const files = [];
    const searchDir = process.cwd();
    
    const walkDir = (dir) => {
      const items = fs.readdirSync(dir);
      
      items.forEach(item => {
        const fullPath = path.join(dir, item);
        const stat = fs.statSync(fullPath);
        
        if (stat.isDirectory()) {
          walkDir(fullPath);
        }

转载自CSDN-专业IT技术社区

原文链接：https://blog.csdn.net/2401_83797894/article/details/160634743