优化

common-security/src/main/java/com/baiyue/common/security/HttpSessionStateVerifier.java

@@ -0,0 +1,44 @@
+package com.baiyue.common.security;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.time.Duration;
+import java.util.Map;
+
+/** Bounded, non-redirecting internal call. Never forwards an end-user Authorization header. */
+public final class HttpSessionStateVerifier implements SessionStateVerifier {
+    private final HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(1))
+        .followRedirects(HttpClient.Redirect.NEVER).build();
+    private final URI uri;
+    private final String token;
+    private final ObjectMapper mapper;
+
+    public HttpSessionStateVerifier(String uri, String token, ObjectMapper mapper) {
+        this.uri = URI.create(uri);
+        this.token = token;
+        this.mapper = mapper;
+    }
+
+    @Override public void verify(String jwtId, Long userId) {
+        try {
+            var request = HttpRequest.newBuilder(uri).timeout(Duration.ofSeconds(4))
+                .header("Content-Type", "application/json").header("X-Internal-Service-Token", token)
+                .POST(HttpRequest.BodyPublishers.ofByteArray(mapper.writeValueAsBytes(
+                    Map.of("jwtId", jwtId, "userId", userId)))).build();
+            var response = client.send(request, HttpResponse.BodyHandlers.ofString());
+            var body = mapper.readTree(response.body());
+            if (response.statusCode() != 200 || body == null || !body.path("code").isTextual() || !"200".equals(body.path("code").asText())
+                    || !body.path("data").isBoolean() || !body.path("data").booleanValue()) {
+                throw new IllegalArgumentException("Authorization state is revoked or unavailable");
+            }
+        } catch (InterruptedException failure) {
+            Thread.currentThread().interrupt();
+            throw new IllegalArgumentException("Authorization state validation interrupted", failure);
+        } catch (Exception failure) {
+            throw new IllegalArgumentException("Authorization state is revoked or unavailable", failure);
+        }
+    }
+}