优化

auth/src/main/resources/application-dev.yml

@@ -1,10 +0,0 @@
-spring:
-  cloud:
-    nacos:
-      discovery:
-        ip: ${NACOS_DISCOVERY_IP:127.0.0.1}
-  datasource:
-    driver-class-name: com.mysql.cj.jdbc.Driver
-    url: ${AUTH_DB_URL:jdbc:mysql://127.0.0.1:3306/baiyue_auth?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&rewriteBatchedStatements=true}
-    username: ${AUTH_DB_USERNAME:root}
-    password: ${AUTH_DB_PASSWORD:123456}

auth/src/main/resources/application-test.yml

@@ -1,15 +0,0 @@
-spring:
-  cloud:
-    nacos:
-      config:
-        namespace: ${NACOS_NAMESPACE:test}
-        group: ${NACOS_GROUP:BAIYUE}
-        encode: UTF-8
-      discovery:
-        namespace: ${NACOS_NAMESPACE:test}
-        group: ${NACOS_GROUP:BAIYUE}
-  datasource:
-    driver-class-name: com.mysql.cj.jdbc.Driver
-    url: ${AUTH_TEST_DB_URL:jdbc:mysql://${TEST_DB_HOST:8.163.30.128}:${TEST_DB_PORT:3306}/baiyue_auth?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai&useSSL=false&allowPublicKeyRetrieval=true&rewriteBatchedStatements=true}
-    username: ${AUTH_TEST_DB_USERNAME:${TEST_DB_USERNAME:root}}
-    password: ${AUTH_TEST_DB_PASSWORD:${TEST_DB_PASSWORD}}

auth/src/main/resources/application.yml

@@ -2,35 +2,35 @@ server:
   port: ${AUTH_PORT:9100}
 spring:
   profiles:
-    active: ${SPRING_PROFILES_ACTIVE:dev}
+    active: ${SPRING_PROFILES_ACTIVE:test}
   application:
     name: auth-service
   config:
     import:
-      - optional:nacos:baiyue-common.yml?group=BAIYUE&refreshEnabled=true
-      - optional:nacos:${spring.application.name}.yml?group=BAIYUE&refreshEnabled=true
+      - nacos:baiyue-common.yml?group=${NACOS_GROUP:BAIYUE}&refreshEnabled=true
+      - nacos:${spring.application.name}.yml?group=${NACOS_GROUP:BAIYUE}&refreshEnabled=true
   data:
     redis:
-      host: ${REDIS_HOST:127.0.0.1}
+      host: ${REDIS_HOST}
       port: ${REDIS_PORT:6379}
       password: ${REDIS_PASSWORD:}
       database: ${REDIS_DATABASE:0}
       timeout: ${REDIS_TIMEOUT:3s}
   cloud:
     nacos:
-      server-addr: ${NACOS_SERVER_ADDR:127.0.0.1:8848}
-      username: ${NACOS_USERNAME:nacos}
-      password: ${NACOS_PASSWORD:nacos}
+      server-addr: ${NACOS_SERVER_ADDR}
+      username: ${NACOS_USERNAME}
+      password: ${NACOS_PASSWORD}
       discovery:
         enabled: ${NACOS_DISCOVERY_ENABLED:true}
         register-enabled: ${NACOS_REGISTER_ENABLED:true}
         group: ${NACOS_GROUP:BAIYUE}
-        namespace: ${NACOS_NAMESPACE:public}
+        namespace: ${NACOS_NAMESPACE}
       config:
-        namespace: ${NACOS_NAMESPACE:public}
+        namespace: ${NACOS_NAMESPACE}
         encode: UTF-8
 baiyue.security:
-  internal-service-token: ${INTERNAL_SERVICE_TOKEN:change-me-to-an-internal-token-at-least-32-bytes-long}
+  internal-service-token: ${INTERNAL_SERVICE_TOKEN}
   token-key-prefix: ${REDIS_TOKEN_KEY_PREFIX:baiyue:auth}
   issuer: ${JWT_ISSUER:auth-service}
   audience: ${JWT_AUDIENCE:lastleg-api}
@@ -40,7 +40,7 @@ baiyue.security:
   lock-duration: ${LOGIN_LOCK_DURATION:15m}
   jwt-mode: jwks
   session-mode: redis
-  jwk-set-uri: ${JWT_JWKS_URI:http://auth-service:9100/api/auth/.well-known/jwks.json}
+  jwk-set-uri: ${JWT_JWKS_URI:http://auth:9100/api/auth/.well-known/jwks.json}
   jwt:
     rsa-jwk-set: ${JWT_RSA_JWK_SET:}
     current-kid: ${JWT_CURRENT_KID:}
@@ -50,3 +50,5 @@ baiyue.clients:
     url: ${IAM_SERVICE_URL:}
 
 management.endpoints.web.exposure.include: health,info,prometheus
+
+baiyue.security.session-validation-uri: ${AUTH_SESSION_VALIDATION_URL:http://auth:9100/internal/auth/accounts/sessions/validate}

auth/src/main/resources/openapi/auth-internal.yaml

@@ -0,0 +1,39 @@
+openapi: 3.0.3
+info:
+  title: Auth internal session validation
+  version: 1.0.0
+paths:
+  /internal/auth/accounts/sessions/validate:
+    post:
+      summary: Validate persisted account and IAM authorization state
+      description: Internal network only. No Gateway public route. Verifies the Redis Access session and state fingerprint against current Auth account and a consistent IAM snapshot. No positive cache; missing state, stale state and dependency failure deny access. Does not accept or forward a user Bearer token.
+      security:
+        - internalServiceToken: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [jwtId, userId]
+              properties:
+                jwtId: {type: string, minLength: 1}
+                userId: {type: integer, format: int64}
+      responses:
+        '200':
+          description: Only string code 200 and boolean data true constitute success. Business errors deny access.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [code]
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {type: boolean, nullable: true}
+components:
+  securitySchemes:
+    internalServiceToken:
+      type: apiKey
+      in: header
+      name: X-Internal-Service-Token