暂存提交

2026-07-30 18:01:36 +08:00
commit 2f4e159356
368 changed files with 20370 additions and 0 deletions
@@ -0,0 +1,48 @@
+server:
+  port: ${AUTH_PORT:9100}
+spring:
+  application:
+    name: auth-service
+  config:
+    import:
+      - optional:nacos:baiyue-common.yml?group=BAIYUE&refreshEnabled=true
+      - optional:nacos:${spring.application.name}.yml?group=BAIYUE&refreshEnabled=true
+  data:
+    redis:
+      host: ${REDIS_HOST:127.0.0.1}
+      port: ${REDIS_PORT:6379}
+      password: ${REDIS_PASSWORD:}
+      database: ${REDIS_DATABASE:0}
+      timeout: ${REDIS_TIMEOUT:3s}
+  cloud:
+    nacos:
+      server-addr: ${NACOS_SERVER_ADDR:127.0.0.1:8848}
+      username: ${NACOS_USERNAME:nacos}
+      password: ${NACOS_PASSWORD:nacos}
+      discovery:
+        enabled: ${NACOS_DISCOVERY_ENABLED:true}
+        register-enabled: ${NACOS_REGISTER_ENABLED:true}
+        group: ${NACOS_GROUP:BAIYUE}
+        namespace: ${NACOS_NAMESPACE:public}
+      config.namespace: ${NACOS_NAMESPACE:public}
+  datasource:
+    driver-class-name: com.mysql.cj.jdbc.Driver
+    url: ${AUTH_DB_URL:jdbc:mysql://127.0.0.1:3306/baiyue_auth?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&rewriteBatchedStatements=true}
+    username: ${AUTH_DB_USERNAME:root}
+    password: ${AUTH_DB_PASSWORD:123456}
+
+baiyue.security:
+  jwt-secret: ${JWT_SECRET:change-me-to-at-least-32-bytes-long-before-start}
+  internal-service-token: ${INTERNAL_SERVICE_TOKEN:change-me-to-an-internal-token-at-least-32-bytes-long}
+  token-key-prefix: ${REDIS_TOKEN_KEY_PREFIX:baiyue:auth}
+  issuer: ${JWT_ISSUER:auth-service}
+  access-token-ttl: ${ACCESS_TOKEN_TTL:30m}
+  refresh-token-ttl: ${REFRESH_TOKEN_TTL:7d}
+  max-login-failures: ${MAX_LOGIN_FAILURES:5}
+  lock-duration: ${LOGIN_LOCK_DURATION:15m}
+
+baiyue.clients:
+  iam:
+    url: ${IAM_SERVICE_URL:}
+
+management.endpoints.web.exposure.include: health,info,prometheus
@@ -0,0 +1,44 @@
+SET NAMES utf8mb4;
+CREATE DATABASE IF NOT EXISTS baiyue_auth
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
+USE baiyue_auth;
+
+CREATE TABLE IF NOT EXISTS auth_account (
+  id BIGINT NOT NULL COMMENT '统一登录账号ID（雪花ID）',
+  username VARCHAR(64) NOT NULL COMMENT '全局唯一登录名',
+  password_hash VARCHAR(255) NOT NULL COMMENT 'BCrypt密码哈希，禁止保存明文密码',
+  display_name VARCHAR(64) NOT NULL COMMENT '登录后展示名称',
+  account_status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' COMMENT '账号状态：ACTIVE、DISABLED、LOCKED',
+  failed_login_count INT NOT NULL DEFAULT 0 COMMENT '连续登录失败次数',
+  locked_until DATETIME(3) DEFAULT NULL COMMENT '临时锁定截止时间',
+  token_version INT NOT NULL DEFAULT 1 COMMENT '令牌版本，递增后可使历史令牌失效',
+  default_tenant_id BIGINT NOT NULL COMMENT '默认业务租户ID',
+  operator_tenant_id BIGINT NOT NULL COMMENT '操作主体租户ID，平台端与商户端身份隔离',
+  default_membership_id BIGINT DEFAULT NULL COMMENT '默认租户成员关系ID',
+  default_app_code VARCHAR(20) NOT NULL COMMENT '默认应用端：MERCHANT或PLATFORM',
+  deleted TINYINT NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
+  last_login_at DATETIME(3) DEFAULT NULL COMMENT '最近一次成功登录时间',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_auth_account_username (username),
+  KEY idx_auth_account_status (account_status, locked_until)
+) ENGINE=InnoDB COMMENT='统一登录账号表：保存平台端和商户端共用的认证凭据及账号安全状态';
+
+CREATE TABLE IF NOT EXISTS auth_refresh_token (
+  id BIGINT NOT NULL COMMENT '刷新令牌记录ID（雪花ID）',
+  token_hash CHAR(64) NOT NULL COMMENT '刷新令牌SHA-256摘要，不保存令牌明文',
+  user_id BIGINT NOT NULL COMMENT '认证账号ID',
+  tenant_id BIGINT NOT NULL COMMENT '令牌当前业务租户ID',
+  operator_tenant_id BIGINT NOT NULL COMMENT '令牌操作主体租户ID',
+  app_code VARCHAR(20) NOT NULL COMMENT '令牌所属应用端',
+  expires_at DATETIME(3) NOT NULL COMMENT '到期时间',
+  revoked_at DATETIME(3) DEFAULT NULL COMMENT '吊销时间，非空表示不可继续使用',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '签发时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_auth_refresh_hash (token_hash),
+  KEY idx_auth_refresh_user (user_id, revoked_at, expires_at),
+  KEY idx_auth_refresh_expire (expires_at, revoked_at)
+) ENGINE=InnoDB COMMENT='刷新令牌表：保存令牌摘要、租户上下文、有效期和轮换/吊销状态';
+
+-- 初始管理员密码必须由部署脚本生成 BCrypt 哈希后显式写入，仓库内禁止提供默认密码。
@@ -0,0 +1,26 @@
+-- Phase-one local administrator accounts.
+-- Development-only initial password: ChangeMe123!
+-- The BCrypt hash is intentionally stored instead of plaintext.
+USE baiyue_auth;
+SET NAMES utf8mb4;
+
+INSERT INTO auth_account (
+  id, username, password_hash, display_name, account_status,
+  failed_login_count, token_version, default_tenant_id,
+  operator_tenant_id, default_membership_id, default_app_code, deleted
+) VALUES
+  (1000001, 'platform_admin', '$2a$12$AMZJjd88leYPLI9uKvjZiew2CTQXI32BXoHFX.FrCi28/IeZ7mZ96',
+   '平台管理员', 'ACTIVE', 0, 1, 0, 0, 3000001, 'PLATFORM', 0),
+  (1000002, 'merchant_admin', '$2a$12$AMZJjd88leYPLI9uKvjZiew2CTQXI32BXoHFX.FrCi28/IeZ7mZ96',
+   '一期演示企业管理员', 'ACTIVE', 0, 1, 10001, 10001, 3000002, 'MERCHANT', 0)
+ON DUPLICATE KEY UPDATE
+  password_hash = VALUES(password_hash),
+  display_name = VALUES(display_name),
+  account_status = 'ACTIVE',
+  failed_login_count = 0,
+  locked_until = NULL,
+  default_tenant_id = VALUES(default_tenant_id),
+  operator_tenant_id = VALUES(operator_tenant_id),
+  default_membership_id = VALUES(default_membership_id),
+  default_app_code = VALUES(default_app_code),
+  deleted = 0;