优化

auth/src/main/java/com/baiyue/auth/service/OverseasTokenService.java

@@ -19,12 +19,21 @@ import org.springframework.stereotype.Service;
 
 import java.time.Instant;
 import java.util.List;
+import java.util.Set;
 import java.util.UUID;
+import java.util.stream.Collectors;
 
 /** 将已经通过国内 HMAC 与 Redis 校验的会话兑换为海外 RS256 短时令牌。 */
 @Service
 @ConditionalOnProperty(name = "baiyue.security.overseas-jwt.enabled", havingValue = "true")
 public class OverseasTokenService {
+    private static final List<String> OVERSEAS_AUTHORITY_PREFIXES = List.of(
+        "platform:overseas-warehouse:",
+        "platform:overseas-business:",
+        "platform:overseas-master-data:",
+        "lastleg:"
+    );
+
     @Resource private AuthAccountRepository accounts;
     @Resource private AuthorizationLoader authorizationLoader;
     @Resource private OverseasJwtProperties properties;
@@ -50,7 +59,7 @@ public class OverseasTokenService {
             .claim("membership_id", authorization.getMembershipId())
             .claim("app_code", authorization.getAppCode()).claim("client_type", authorization.getClientType())
             .claim("roles", authorization.getRoles())
-            .claim("authorities", authorization.getPermissions())
+            .claim("authorities", overseasAuthorities(authorization.getPermissions()))
             .claim("permission_version", authorization.getPermissionVersion() == null ? 0L : authorization.getPermissionVersion())
             .build();
         String token = encoder.encode(JwtEncoderParameters.from(
@@ -58,5 +67,12 @@ public class OverseasTokenService {
         return new OverseasTokenResponse("Bearer", token, properties.accessTokenTtl().toSeconds());
     }
 
+    private Set<String> overseasAuthorities(Set<String> permissions) {
+        if (permissions == null || permissions.isEmpty()) return Set.of();
+        return permissions.stream()
+            .filter(permission -> permission != null && OVERSEAS_AUTHORITY_PREFIXES.stream().anyMatch(permission::startsWith))
+            .collect(Collectors.toUnmodifiableSet());
+    }
+
     public record OverseasTokenResponse(String tokenType, String accessToken, long expiresIn) { }
 }