优化

gateway/src/test/java/com/baiyue/gateway/config/AppScopeAuthorizationManagerTest.java

@@ -15,7 +15,15 @@ class AppScopeAuthorizationManagerTest {
     @Test
     void acceptsMatchingApplicationScope() {
         var manager = new AppScopeAuthorizationManager("MERCHANT");
-        StepVerifier.create(manager.check(Mono.just(authentication("MERCHANT")), null))
+        StepVerifier.create(manager.check(Mono.just(authentication("MERCHANT", 10001L)), null))
+                .expectNextMatches(decision -> decision.isGranted())
+                .verifyComplete();
+    }
+
+    @Test
+    void acceptsPlatformOnlyInPlatformTenant() {
+        var manager = new AppScopeAuthorizationManager("PLATFORM");
+        StepVerifier.create(manager.check(Mono.just(authentication("PLATFORM", 0L)), null))
                 .expectNextMatches(decision -> decision.isGranted())
                 .verifyComplete();
     }
@@ -23,7 +31,23 @@ class AppScopeAuthorizationManagerTest {
     @Test
     void rejectsDifferentApplicationScope() {
         var manager = new AppScopeAuthorizationManager("PLATFORM");
-        StepVerifier.create(manager.check(Mono.just(authentication("MERCHANT")), null))
+        StepVerifier.create(manager.check(Mono.just(authentication("MERCHANT", 10001L)), null))
+                .expectNextMatches(decision -> !decision.isGranted())
+                .verifyComplete();
+    }
+
+    @Test
+    void rejectsPlatformApplicationWithCustomerTenant() {
+        var manager = new AppScopeAuthorizationManager("PLATFORM");
+        StepVerifier.create(manager.check(Mono.just(authentication("PLATFORM", 10001L)), null))
+                .expectNextMatches(decision -> !decision.isGranted())
+                .verifyComplete();
+    }
+
+    @Test
+    void rejectsMerchantApplicationWithoutPositiveCustomerTenant() {
+        var manager = new AppScopeAuthorizationManager("MERCHANT");
+        StepVerifier.create(manager.check(Mono.just(authentication("MERCHANT", 0L)), null))
                 .expectNextMatches(decision -> !decision.isGranted())
                 .verifyComplete();
     }
@@ -43,13 +67,14 @@ class AppScopeAuthorizationManagerTest {
                 .verifyComplete();
     }
 
-    private JwtAuthenticationToken authentication(String appCode) {
+    private JwtAuthenticationToken authentication(String appCode, long tenantId) {
         Jwt jwt = Jwt.withTokenValue("token")
                 .header("alg", "none")
                 .subject("1")
                 .issuedAt(Instant.now())
                 .expiresAt(Instant.now().plusSeconds(60))
                 .claim("app_code", appCode)
+                .claim("tenant_id", tenantId)
                 .build();
         return new JwtAuthenticationToken(jwt,
                 java.util.List.of(new SimpleGrantedAuthority("authenticated")));

gateway/src/test/java/com/baiyue/gateway/config/GatewayFileRouteConfigurationTest.java

@@ -35,6 +35,22 @@ class GatewayFileRouteConfigurationTest {
         });
     }
 
+    @Test
+    void iamRouteDoesNotExposeUnscopedCompatibilityPath() {
+        var route = gatewayProperties.getRoutes().stream()
+            .filter(candidate -> "iam-service".equals(candidate.getId()))
+            .findFirst()
+            .orElseThrow();
+
+        assertThat(route.getPredicates()).singleElement().satisfies(predicate -> {
+            assertThat(predicate.getName()).isEqualTo("Path");
+            assertThat(String.join(",", predicate.getArgs().values()))
+                .contains("/api/platform/v1/iam/**")
+                .contains("/api/merchant/v1/iam/**")
+                .doesNotContain("/api/iam/**");
+        });
+    }
+
     @Test
     void warehouseResourceRequestsRouteToWarehouseService() {
         var route = gatewayProperties.getRoutes().stream()