优化

gateway/src/test/java/com/baiyue/gateway/config/CustomerTransitStatisticsRouteContractTest.java

@@ -12,7 +12,7 @@ import static org.assertj.core.api.Assertions.assertThat;
     "spring.cloud.nacos.discovery.register-enabled=false",
     "spring.cloud.nacos.config.enabled=false",
     "spring.cloud.gateway.discovery.locator.enabled=false",
-    "baiyue.security.jwt-secret=test-jwt-secret-at-least-32-bytes-long"
+    "baiyue.security.jwk-set-uri=http://127.0.0.1:1/jwks"
 })
 class CustomerTransitStatisticsRouteContractTest {
     @Autowired private GatewayProperties gatewayProperties;

gateway/src/test/java/com/baiyue/gateway/config/GatewayCorsConfigurationTest.java

@@ -18,7 +18,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
     "spring.cloud.nacos.discovery.register-enabled=false",
     "spring.cloud.nacos.config.enabled=false",
     "spring.cloud.gateway.discovery.locator.enabled=false",
-    "baiyue.security.jwt-secret=test-jwt-secret-at-least-32-bytes-long",
+    "baiyue.security.jwk-set-uri=http://127.0.0.1:1/jwks",
     "baiyue.cors.allowed-origins=http://localhost:5173,http://localhost:5174"
 })
 @AutoConfigureWebTestClient

gateway/src/test/java/com/baiyue/gateway/config/GatewayFileRouteConfigurationTest.java

@@ -14,7 +14,7 @@ import static org.assertj.core.api.Assertions.assertThat;
     "spring.cloud.nacos.discovery.register-enabled=false",
     "spring.cloud.nacos.config.enabled=false",
     "spring.cloud.gateway.discovery.locator.enabled=false",
-    "baiyue.security.jwt-secret=test-jwt-secret-at-least-32-bytes-long"
+    "baiyue.security.jwk-set-uri=http://127.0.0.1:1/jwks"
 })
 class GatewayFileRouteConfigurationTest {
     @Autowired

gateway/src/test/java/com/baiyue/gateway/config/UnifiedJwtDecoderTest.java

@@ -0,0 +1,55 @@
+package com.baiyue.gateway.config;
+
+import com.nimbusds.jose.*;
+import com.nimbusds.jose.crypto.RSASSASigner;
+import com.nimbusds.jose.jwk.JWKSet;
+import com.nimbusds.jose.jwk.gen.RSAKeyGenerator;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.SignedJWT;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.oauth2.jwt.JwtException;
+import java.net.InetSocketAddress;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.Date;
+import java.util.List;
+import static org.assertj.core.api.Assertions.*;
+
+class UnifiedJwtDecoderTest {
+    @Test
+    void acceptsUnifiedRsaTokenAndRejectsWrongAudienceIssuerAndExpiry() throws Exception {
+        var key = new RSAKeyGenerator(2048).keyID("current").generate();
+        var server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/jwks", exchange -> {
+            byte[] body = new JWKSet(key.toPublicJWK()).toString().getBytes(StandardCharsets.UTF_8);
+            exchange.getResponseHeaders().add("Content-Type", "application/json");
+            exchange.sendResponseHeaders(200, body.length);
+            try (var output = exchange.getResponseBody()) { output.write(body); }
+        });
+        server.start();
+        try {
+            var properties = new GatewaySecurityProperties("http://127.0.0.1:" + server.getAddress().getPort() + "/jwks",
+                    "auth-service", "lastleg-api", "test:auth", List.of());
+            var decoder = new GatewaySecurityConfig().reactiveJwtDecoder(properties);
+            var signer = new RSASSASigner(key);
+            String valid = token(signer, "auth-service", "lastleg-api", 120);
+            assertThat(decoder.decode(valid).block(Duration.ofSeconds(5)).getSubject()).isEqualTo("42");
+            for (String invalid : List.of(token(signer, "other", "lastleg-api", 120),
+                    token(signer, "auth-service", "other", 120), token(signer, "auth-service", "lastleg-api", -120))) {
+                assertThatThrownBy(() -> decoder.decode(invalid).block(Duration.ofSeconds(5)))
+                        .isInstanceOf(JwtException.class);
+            }
+        } finally { server.stop(0); }
+    }
+
+    private String token(RSASSASigner signer, String issuer, String audience, int ttl) throws Exception {
+        var jwt = new SignedJWT(new JWSHeader.Builder(JWSAlgorithm.RS256).keyID("current").build(),
+                new JWTClaimsSet.Builder().subject("42").issuer(issuer).audience(audience)
+                        .issueTime(Date.from(Instant.now().minusSeconds(300)))
+                        .expirationTime(Date.from(Instant.now().plusSeconds(ttl))).build());
+        jwt.sign(signer);
+        return jwt.serialize();
+    }
+}