优化

gateway/src/main/java/com/baiyue/gateway/config/RedisTokenSessionWebFilter.java

@@ -20,6 +20,17 @@ public class RedisTokenSessionWebFilter implements WebFilter {
     @Resource private ReactiveStringRedisTemplate reactiveStringRedisTemplate;
     @Resource private GatewaySecurityProperties properties;
     @Resource private ObjectMapper objectMapper;
+    @org.springframework.beans.factory.annotation.Value("${baiyue.security.session-validation-uri:http://auth:9100/internal/auth/accounts/sessions/validate}")
+    private String validationUri;
+    @org.springframework.beans.factory.annotation.Value("${baiyue.security.internal-service-token}")
+    private String internalToken;
+    private final org.springframework.web.reactive.function.client.WebClient stateClient =
+        org.springframework.web.reactive.function.client.WebClient.builder()
+            .clientConnector(new org.springframework.http.client.reactive.ReactorClientHttpConnector(
+                reactor.netty.http.client.HttpClient.create()
+                    .option(io.netty.channel.ChannelOption.CONNECT_TIMEOUT_MILLIS, 1000)
+                    .responseTimeout(java.time.Duration.ofSeconds(4)).followRedirect(false)))
+            .build();
 
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
@@ -34,7 +45,19 @@ public class RedisTokenSessionWebFilter implements WebFilter {
                                 WebFilterChain chain) {
         String jwtId = jwt.getToken().getId();
         if (jwtId == null || jwtId.isBlank()) return unauthorized(exchange);
+        Object userId = jwt.getToken().getClaims().get("user_id");
+        if (userId == null) return unauthorized(exchange);
         return reactiveStringRedisTemplate.hasKey(properties.accessTokenKey(jwtId))
+                .flatMap(active -> Boolean.TRUE.equals(active)
+                    ? stateClient.post().uri(validationUri)
+                        .header("X-Internal-Service-Token", internalToken)
+                        .bodyValue(java.util.Map.of("jwtId", jwtId, "userId", userId))
+                        .retrieve().bodyToMono(com.fasterxml.jackson.databind.JsonNode.class)
+                        .map(body -> body.path("code").isTextual() && "200".equals(body.path("code").asText())
+                            && body.path("data").isBoolean() && body.path("data").booleanValue())
+                        .defaultIfEmpty(false)
+                    : Mono.just(false))
+                .timeout(java.time.Duration.ofSeconds(4))
                 .onErrorReturn(false)
                 .flatMap(active -> Boolean.TRUE.equals(active)
                         ? chain.filter(exchange) : unauthorized(exchange));

gateway/src/main/resources/application-cn.yml

@@ -1,10 +0,0 @@
-spring:
-  config:
-    activate:
-      on-profile: cn
-
-baiyue:
-  deployment:
-    region-code: ${REGION_CODE:CN}
-    cell: ${DEPLOYMENT_CELL:cn}
-    data-residency: ${DATA_RESIDENCY:CN}

gateway/src/main/resources/application.yml

@@ -3,7 +3,7 @@ server:
 
 spring:
   profiles:
-    active: ${SPRING_PROFILES_ACTIVE:dev}
+    active: ${SPRING_PROFILES_ACTIVE:test}
     group:
       dev: cn
       test: cn
@@ -14,27 +14,27 @@ spring:
       - org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration
   config:
     import:
-      - optional:nacos:baiyue-common.yml?group=BAIYUE&refreshEnabled=true
-      - optional:nacos:${spring.application.name}.yml?group=BAIYUE&refreshEnabled=true
+      - nacos:baiyue-common.yml?group=${NACOS_GROUP:BAIYUE}&refreshEnabled=true
+      - nacos:${spring.application.name}.yml?group=${NACOS_GROUP:BAIYUE}&refreshEnabled=true
   data:
     redis:
-      host: ${REDIS_HOST:127.0.0.1}
+      host: ${REDIS_HOST}
       port: ${REDIS_PORT:6379}
       password: ${REDIS_PASSWORD:}
       database: ${REDIS_DATABASE:0}
       timeout: ${REDIS_TIMEOUT:3s}
   cloud:
     nacos:
-      server-addr: ${NACOS_SERVER_ADDR:127.0.0.1:8848}
-      username: ${NACOS_USERNAME:nacos}
-      password: ${NACOS_PASSWORD:nacos}
+      server-addr: ${NACOS_SERVER_ADDR}
+      username: ${NACOS_USERNAME}
+      password: ${NACOS_PASSWORD}
       discovery:
         enabled: ${NACOS_DISCOVERY_ENABLED:true}
         register-enabled: ${NACOS_REGISTER_ENABLED:true}
         group: ${NACOS_GROUP:BAIYUE}
-        namespace: ${NACOS_NAMESPACE:public}
+        namespace: ${NACOS_NAMESPACE}
       config:
-        namespace: ${NACOS_NAMESPACE:public}
+        namespace: ${NACOS_NAMESPACE}
     gateway:
       discovery:
         locator:
@@ -157,12 +157,6 @@ spring:
             - Path=/integration-service/v3/api-docs/**
           filters:
             - StripPrefix=1
-        - id: event-bridge-openapi
-          uri: lb://event-bridge-service
-          predicates:
-            - Path=/event-bridge-service/v3/api-docs/**
-          filters:
-            - StripPrefix=1
         - id: finance-openapi
           uri: lb://finance-service
           predicates:
@@ -178,7 +172,7 @@ baiyue:
     allow-credentials: ${CORS_ALLOW_CREDENTIALS:false}
     max-age: ${CORS_MAX_AGE:3600}
   security:
-    jwk-set-uri: ${JWT_JWKS_URI:http://auth-service:9100/api/auth/.well-known/jwks.json}
+    jwk-set-uri: ${JWT_JWKS_URI:http://auth:9100/api/auth/.well-known/jwks.json}
     issuer: ${JWT_ISSUER:auth-service}
     audience: ${JWT_AUDIENCE:lastleg-api}
     token-key-prefix: ${REDIS_TOKEN_KEY_PREFIX:baiyue:auth}
@@ -203,7 +197,6 @@ baiyue:
       - /firstleg-service/v3/api-docs/**
       - /audit-service/v3/api-docs/**
       - /integration-service/v3/api-docs/**
-      - /event-bridge-service/v3/api-docs/**
       - /finance-service/v3/api-docs/**
       - /lastleg-service/v3/api-docs/**
       - /warehouse-overseas-service/v3/api-docs/**
@@ -251,8 +244,6 @@ springdoc:
         url: /audit-service/v3/api-docs
       - name: integration
         url: /integration-service/v3/api-docs
-      - name: event-bridge
-        url: /event-bridge-service/v3/api-docs
       - name: finance
         url: /finance-service/v3/api-docs
       - name: lastleg