test(security): cover gateway token authentication

common-security/src/main/java/com/baiyue/common/security/JwtAuthenticationFilter.java

@@ -12,6 +12,8 @@ import org.springframework.security.oauth2.jwt.JwtDecoder;
 import org.springframework.security.oauth2.jwt.JwtException;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.web.filter.OncePerRequestFilter;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
 
@@ -19,6 +21,7 @@ import java.io.IOException;
  * Servlet JWT 认证过滤器，解析 Bearer 令牌、校验会话并建立当前请求的安全上下文。
  */
 public class JwtAuthenticationFilter extends OncePerRequestFilter {
+    private static final Logger LOG = LoggerFactory.getLogger(JwtAuthenticationFilter.class);
     private static final String BEARER = "Bearer ";
     private final JwtDecoder jwtDecoder;
     private final JwtClaimsMapper claimsMapper;
@@ -60,6 +63,7 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
             SecurityContextHolder.getContext().setAuthentication(authentication);
             filterChain.doFilter(request, response);
         } catch (JwtException | IllegalArgumentException exception) {
+            LOG.warn("JWT authentication rejected for {}: {}", request.getRequestURI(), exception.getMessage());
             SecurityContextHolder.clearContext();
             authenticationEntryPoint.commence(request, response,
                     new InvalidJwtAuthenticationException("Invalid or expired access token", exception));