优化

auth/src/main/java/com/baiyue/auth/service/AuthService.java

@@ -205,10 +205,24 @@ public class AuthService {
         String accessToken = jwtEncoder.encode(JwtEncoderParameters.from(signingHeader(), claims)).getTokenValue();
         tokenSessionStore.storeAccessOnly(jwtId, account.getId(), authorization.getRoles(),
                 authorization.getPermissions(), Duration.ofMinutes(15));
-        return new ImpersonationTokenResponse("Bearer", accessToken, 900);
+        OverseasTokenService service = overseasTokens.getIfAvailable();
+        OverseasTokenService.OverseasTokenResponse overseas = service == null
+                ? null : service.issue(account, authorization);
+        return new ImpersonationTokenResponse("Bearer", accessToken, 900,
+                overseas == null ? null : overseas.accessToken(),
+                overseas == null ? 0L : overseas.expiresIn(),
+                authorization.getRoles(), authorization.getPermissions());
     }
 
-    public record ImpersonationTokenResponse(String tokenType, String accessToken, long expiresIn) { }
+    public record ImpersonationTokenResponse(String tokenType, String accessToken, long expiresIn,
+                                              String overseasAccessToken, long overseasExpiresIn,
+                                              java.util.Set<String> roles,
+                                              java.util.Set<String> authorities) {
+        public ImpersonationTokenResponse {
+            roles = roles == null ? java.util.Set.of() : java.util.Set.copyOf(roles);
+            authorities = authorities == null ? java.util.Set.of() : java.util.Set.copyOf(authorities);
+        }
+    }
 
     private JwsHeader signingHeader() {
         return JwsHeader.with(MacAlgorithm.HS256).build();

auth/src/test/java/com/baiyue/auth/service/AuthServiceSmallJwtTest.java

@@ -225,8 +225,16 @@ class AuthServiceSmallJwtTest {
         when(authorizationLoader.load(account)).thenReturn(snapshot);
         when(jwtEncoder.encode(any())).thenReturn(encoded);
         when(encoded.getTokenValue()).thenReturn("small-impersonation-token");
+        when(overseasTokenService.issue(account, snapshot)).thenReturn(
+                new OverseasTokenService.OverseasTokenResponse("Bearer", "overseas-impersonation-token", 900,
+                        Set.of("MERCHANT_OWNER"), Set.of("merchant:order:list")));
 
-        service.exchangeImpersonationTicket("one-time-code");
+        AuthService.ImpersonationTokenResponse response = service.exchangeImpersonationTicket("one-time-code");
+
+        assertThat(response.overseasAccessToken()).isEqualTo("overseas-impersonation-token");
+        assertThat(response.overseasExpiresIn()).isEqualTo(900);
+        assertThat(response.roles()).containsExactly("MERCHANT_OWNER");
+        assertThat(response.authorities()).containsExactly("merchant:order:list");
 
         ArgumentCaptor<JwtEncoderParameters> jwt = ArgumentCaptor.forClass(JwtEncoderParameters.class);
         verify(jwtEncoder).encode(jwt.capture());
@@ -239,5 +247,6 @@ class AuthServiceSmallJwtTest {
                 org.mockito.ArgumentMatchers.eq(Set.of("MERCHANT_OWNER")),
                 org.mockito.ArgumentMatchers.eq(Set.of("merchant:order:list")),
                 org.mockito.ArgumentMatchers.eq(Duration.ofMinutes(15)));
+        verify(overseasTokenService).issue(account, snapshot);
     }
 }