优化

firstleg/src/test/java/com/baiyue/firstleg/controller/OpenApiInboundMeasurementControllerContractTest.java

@@ -4,6 +4,7 @@ import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.web.bind.annotation.RequestPart;
+import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.multipart.MultipartFile;
 
 import java.lang.reflect.Method;
@@ -22,6 +23,11 @@ class OpenApiInboundMeasurementControllerContractTest {
         assertThat(method.getParameters()[5].getAnnotation(RequestPart.class).value()).isEqualTo("data");
         assertThat(method.getParameters()[5].getType()).isEqualTo(String.class);
         assertThat(method.getParameters()[6].getAnnotation(RequestPart.class).value()).isEqualTo("image");
+        assertThat(method.getParameters()[0].getAnnotation(RequestHeader.class).required()).isTrue();
+        assertThat(method.getParameters()[1].getAnnotation(RequestHeader.class).required()).isFalse();
+        assertThat(method.getParameters()[2].getAnnotation(RequestHeader.class).required()).isFalse();
+        assertThat(method.getParameters()[3].getAnnotation(RequestHeader.class).required()).isFalse();
+        assertThat(method.getParameters()[4].getAnnotation(RequestHeader.class).required()).isTrue();
     }
 
     @Test

firstleg/src/test/java/com/baiyue/firstleg/security/MeasurementRequestAuthenticatorTest.java

@@ -21,6 +21,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.verifyNoInteractions;
 
 @DisplayName("第三方测量请求签名校验")
 @SpringJUnitConfig(classes = {MeasurementRequestAuthenticator.class,
@@ -35,6 +36,7 @@ class MeasurementRequestAuthenticatorTest {
     @BeforeEach
     void setUp() {
         properties.setEnabled(true);
+        properties.setSignatureRequired(true);
         MeasurementOpenApiProperties.AppCredential credential = new MeasurementOpenApiProperties.AppCredential();
         credential.setSecret(SECRET);
         credential.setTenantId(10001L);
@@ -99,6 +101,34 @@ class MeasurementRequestAuthenticatorTest {
                         .isEqualTo(ResultCode.CONFLICT));
     }
 
+    @Test
+    @DisplayName("联调关闭签名时只用固定AppKey和幂等键认证且不占用Nonce")
+    void shouldAcceptFixedAppKeyWithoutSignatureDuringIntegration() {
+        properties.setSignatureRequired(false);
+        properties.getApps().get("device-provider").setSecret(null);
+
+        AuthenticatedMeasurementApp app = authenticator.authenticate("POST",
+                "/openapi/v1/inbound-measurements",
+                new MeasurementRequestHeaders("device-provider", null, null, null, "idem-1"),
+                "{}", true);
+
+        assertThat(app.tenantId()).isEqualTo(10001L);
+        assertThat(app.subjectId()).isEqualTo(90001L);
+        verifyNoInteractions(guard);
+    }
+
+    @Test
+    @DisplayName("关闭签名仍强制上传请求携带幂等键")
+    void shouldStillRequireIdempotencyKeyWithoutSignature() {
+        properties.setSignatureRequired(false);
+
+        assertThatThrownBy(() -> authenticator.authenticate("POST",
+                "/openapi/v1/inbound-measurements",
+                new MeasurementRequestHeaders("device-provider", null, null, null, null), "{}", true))
+                .isInstanceOf(BizException.class)
+                .hasMessageContaining("Idempotency-Key");
+    }
+
     @Configuration
     static class TestConfig {
         @Bean