优化

common-security/src/main/java/com/baiyue/common/security/BaiyueSecurityAutoConfiguration.java

@@ -23,7 +23,7 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic
  * Servlet 服务安全自动配置，建立无状态 JWT 认证链、统一异常响应和审计操作者解析。
  */
 @AutoConfiguration(
-        after = {HmacJwtDecoderAutoConfiguration.class, JwksJwtDecoderAutoConfiguration.class},
+        after = JwksJwtDecoderAutoConfiguration.class,
         before = SecurityAutoConfiguration.class)
 @EnableMethodSecurity
 public class BaiyueSecurityAutoConfiguration {
@@ -50,16 +50,13 @@ public class BaiyueSecurityAutoConfiguration {
                                                       org.springframework.beans.factory.ObjectProvider<StringRedisTemplate> redis,
                                                       ObjectMapper objectMapper,
                                                       @Value("${baiyue.security.token-key-prefix:baiyue:auth}") String keyPrefix,
-                                                      @Value("${baiyue.security.gateway-internal-service-token:${baiyue.security.internal-service-token:${INTERNAL_SERVICE_TOKEN:}}}") String gatewayToken,
                                                       @Value("${baiyue.security.session-mode:redis}") String sessionMode) {
-        AccessTokenSessionValidator validator;
-        if ("claims".equalsIgnoreCase(sessionMode)) validator = new ClaimsAccessTokenSessionValidator();
-        else if ("gateway".equalsIgnoreCase(sessionMode)) validator = new GatewayAccessTokenSessionValidator(gatewayToken);
-        else {
-            StringRedisTemplate template=redis.getIfAvailable();
-            if(template==null) throw new IllegalStateException("session-mode=redis requires StringRedisTemplate");
-            validator=new RedisAccessTokenSessionValidator(template,keyPrefix,objectMapper);
+        if (!"redis".equalsIgnoreCase(sessionMode)) {
+            throw new IllegalStateException("Only shared Redis access sessions are supported");
         }
+        StringRedisTemplate template = redis.getIfAvailable();
+        if (template == null) throw new IllegalStateException("Redis access sessions require StringRedisTemplate");
+        AccessTokenSessionValidator validator = new RedisAccessTokenSessionValidator(template, keyPrefix, objectMapper);
         return new JwtAuthenticationFilter(jwtDecoder, claimsMapper, entryPoint, validator);
     }