优化

auth/src/main/java/com/baiyue/auth/client/AuthorizationLoader.java

@@ -10,6 +10,8 @@ import feign.FeignException;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
+import java.util.Objects;
+
 /**
  * 授权快照加载器，调用 IAM 服务并校验返回身份上下文，为认证令牌组装权限声明。
  */
@@ -42,10 +44,17 @@ public class AuthorizationLoader {
                 }
                 throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM 权限服务暂时不可用");
             }
-            if (response.data() == null) {
+            AuthorizationSnapshot snapshot = response.data();
+            if (snapshot == null) {
                 throw new BizException(ResultCode.FORBIDDEN, "账号没有有效的 IAM 身份或权限");
             }
-            return response.data();
+            if (!Objects.equals(account.getId(), snapshot.getUserId())
+                    || !Objects.equals(account.getDefaultTenantId(), snapshot.getTenantId())
+                    || !Objects.equals(account.getDefaultMembershipId(), snapshot.getMembershipId())
+                    || !Objects.equals(account.getDefaultAppCode(), snapshot.getAppCode())) {
+                throw new BizException(ResultCode.FORBIDDEN, "IAM 授权快照身份与账号归属不一致");
+            }
+            return snapshot;
         } catch (FeignException exception) {
             throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "IAM 权限服务暂时不可用");
         } catch (BizException exception) {

auth/src/main/java/com/baiyue/auth/controller/InternalAccountController.java

@@ -25,7 +25,15 @@ public class InternalAccountController {
     private String configuredToken;
     private byte[] tokenBytes;
 
-    @PostConstruct void init() { tokenBytes = configuredToken.getBytes(StandardCharsets.UTF_8); }
+    @PostConstruct
+    void init() {
+        byte[] configured = configuredToken == null
+                ? new byte[0] : configuredToken.getBytes(StandardCharsets.UTF_8);
+        if (configured.length < 32) {
+            throw new IllegalStateException("INTERNAL_SERVICE_TOKEN 至少需要 32 字节");
+        }
+        tokenBytes = configured;
+    }
 
     @PostMapping
     public ApiResponse<AccountSummary> create(@RequestHeader(value="X-Internal-Service-Token", required=false) String token,