fix: project overseas authorization outside jwt

2026-09-07 11:37:06 +08:00
parent 6b479d1a68
commit 4963889024
33 changed files with 382 additions and 92 deletions
@@ -0,0 +1,46 @@
+package com.baiyue.common.security;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.oauth2.jwt.Jwt;
+
+import java.time.Instant;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class GatewayAccessTokenSessionValidatorTest {
+    private final GatewayAccessTokenSessionValidator validator =
+        new GatewayAccessTokenSessionValidator("gateway-secret");
+
+    @Test void acceptsOnlyGatewayAuthenticatedAuthorizationSnapshot() {
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        request.addHeader(GatewayAccessTokenSessionValidator.TOKEN_HEADER, "gateway-secret");
+        request.addHeader(GatewayAccessTokenSessionValidator.ROLES_HEADER, "PLATFORM_ADMIN");
+        request.addHeader(GatewayAccessTokenSessionValidator.AUTHORITIES_HEADER,
+            "platform:overseas-warehouse:last-mile-order:list,platform:finance:fee-source:view");
+
+        AccessTokenSession session = validator.validate(jwt(), request);
+
+        assertThat(session.userId()).isEqualTo(42L);
+        assertThat(session.roles()).containsExactly("PLATFORM_ADMIN");
+        assertThat(session.permissions()).containsExactlyInAnyOrder(
+            "platform:overseas-warehouse:last-mile-order:list", "platform:finance:fee-source:view");
+    }
+
+    @Test void rejectsForgedOrMissingGatewayToken() {
+        MockHttpServletRequest forged = new MockHttpServletRequest();
+        forged.addHeader(GatewayAccessTokenSessionValidator.TOKEN_HEADER, "forged");
+        forged.addHeader(GatewayAccessTokenSessionValidator.AUTHORITIES_HEADER,
+            "platform:overseas-warehouse:last-mile-order:list");
+        assertThatThrownBy(() -> validator.validate(jwt(), forged))
+            .isInstanceOf(IllegalArgumentException.class).hasMessageContaining("Untrusted");
+    }
+
+    private Jwt jwt() {
+        return Jwt.withTokenValue("small-overseas-token").header("alg", "RS256").subject("42")
+            .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
+            .claim("user_id", 42L).claim("tenant_id", 0L).claim("app_code", "PLATFORM")
+            .claim("permission_version", 7L).claim("token_version", 1).build();
+    }
+}