fix(security): accept overseas token subject identity

common-security/src/main/java/com/baiyue/common/security/GatewayAccessTokenSessionValidator.java

@@ -35,6 +35,9 @@ public final class GatewayAccessTokenSessionValidator implements AccessTokenSess
             throw new IllegalArgumentException("Untrusted overseas gateway authorization context");
         }
         Long userId = number(jwt.getClaims().getOrDefault("userId", jwt.getClaims().get("user_id")));
+        if (userId == null) {
+            userId = number(jwt.getSubject());
+        }
         return new AccessTokenSession(1, userId, values(request.getHeader(ROLES_HEADER)),
             values(request.getHeader(AUTHORITIES_HEADER)));
     }

common-security/src/test/java/com/baiyue/common/security/GatewayAccessTokenSessionValidatorTest.java

@@ -40,7 +40,7 @@ class GatewayAccessTokenSessionValidatorTest {
     private Jwt jwt() {
         return Jwt.withTokenValue("small-overseas-token").header("alg", "RS256").subject("42")
             .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
-            .claim("user_id", 42L).claim("tenant_id", 0L).claim("app_code", "PLATFORM")
+            .claim("tenant_id", 0L).claim("app_code", "PLATFORM")
             .claim("permission_version", 7L).claim("token_version", 1).build();
     }
 }