优化

common-openapi/src/main/java/com/baiyue/common/openapi/BaiyueOpenApiAutoConfiguration.java

@@ -36,11 +36,8 @@ public class BaiyueOpenApiAutoConfiguration {
     }
 
     @Bean
-    OperationCustomizer tenantHeaderCustomizer() {
+    OperationCustomizer correlationHeaderCustomizer() {
         return (operation, method) -> operation
-            .addParametersItem(header("X-Tenant-Id", "Current tenant ID / 当前租户 ID", false))
-            .addParametersItem(header("X-Operator-Tenant-Id", "Operator tenant ID / 运营方租户 ID", false))
-            .addParametersItem(header("X-App-Code", "Application code / 应用编码", false))
             .addParametersItem(header("X-Request-Id", "Request correlation ID / 请求关联 ID", false))
             .addParametersItem(header("X-Trace-Id", "Distributed trace ID / 分布式追踪 ID", false));
     }
@@ -62,20 +59,20 @@ public class BaiyueOpenApiAutoConfiguration {
     }
 
     @Bean
-    GroupedOpenApi platformApi(OperationCustomizer tenantHeaderCustomizer) {
+    GroupedOpenApi platformApi(OperationCustomizer correlationHeaderCustomizer) {
         return GroupedOpenApi.builder().group("platform")
             .displayName("Platform APIs / 平台端接口")
             .pathsToMatch("/api/platform/**", "/api/auth/**", "/api/iam/platform/**")
-            .addOperationCustomizer(tenantHeaderCustomizer).build();
+            .addOperationCustomizer(correlationHeaderCustomizer).build();
     }
 
     @Bean
-    GroupedOpenApi merchantApi(OperationCustomizer tenantHeaderCustomizer) {
+    GroupedOpenApi merchantApi(OperationCustomizer correlationHeaderCustomizer) {
         return GroupedOpenApi.builder().group("merchant")
             .displayName("Merchant APIs / 商户端接口")
             .pathsToMatch("/api/merchant/**", "/api/orders/**", "/api/warehouse/**",
                 "/api/firstleg/**", "/api/lastleg/**")
-            .addOperationCustomizer(tenantHeaderCustomizer).build();
+            .addOperationCustomizer(correlationHeaderCustomizer).build();
     }
 
     private Parameter header(String name, String description, boolean required) {

common-openapi/src/test/java/com/baiyue/common/openapi/CorrelationHeaderCustomizerTest.java

@@ -0,0 +1,25 @@
+package com.baiyue.common.openapi;
+
+import io.swagger.v3.oas.models.Operation;
+import io.swagger.v3.oas.models.parameters.Parameter;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.springdoc.core.customizers.OperationCustomizer;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@DisplayName("OpenAPI 请求头定制")
+class CorrelationHeaderCustomizerTest {
+
+    @Test
+    void shouldOnlyExposeCallerControlledCorrelationHeaders() {
+        OperationCustomizer customizer = new BaiyueOpenApiAutoConfiguration().correlationHeaderCustomizer();
+
+        Operation operation = customizer.customize(new Operation(), null);
+
+        assertThat(operation.getParameters())
+                .extracting(Parameter::getName)
+                .containsExactly("X-Request-Id", "X-Trace-Id")
+                .doesNotContain("X-Tenant-Id", "X-Operator-Tenant-Id", "X-App-Code");
+    }
+}