108 lines
5.9 KiB
Java
108 lines
5.9 KiB
Java
package com.baiyue.auth.controller;
|
|
|
|
import com.baiyue.auth.service.AuthService;
|
|
import com.baiyue.auth.dto.LoginRequest;
|
|
import com.baiyue.auth.dto.RefreshRequest;
|
|
import com.baiyue.auth.dto.TokenResponse;
|
|
import com.baiyue.auth.dto.MerchantRegisterRequest;
|
|
import com.baiyue.auth.dto.MerchantRegisterResponse;
|
|
import com.baiyue.auth.service.MerchantRegistrationService;
|
|
import com.baiyue.common.core.api.ApiResponse;
|
|
import com.baiyue.common.core.api.ResultCode;
|
|
import com.baiyue.common.core.exception.BizException;
|
|
import io.swagger.v3.oas.annotations.Operation;
|
|
import io.swagger.v3.oas.annotations.responses.ApiResponses;
|
|
import io.swagger.v3.oas.annotations.security.SecurityRequirements;
|
|
import io.swagger.v3.oas.annotations.tags.Tag;
|
|
import jakarta.annotation.Resource;
|
|
import jakarta.validation.Valid;
|
|
import org.springframework.web.bind.annotation.*;
|
|
import org.springframework.security.core.annotation.AuthenticationPrincipal;
|
|
import com.baiyue.common.security.AuthenticatedUser;
|
|
import com.baiyue.auth.dto.AccountManagementDtos.ChangePasswordRequest;
|
|
import com.baiyue.auth.dto.AccountManagementDtos.ForcedPasswordChangeRequest;
|
|
import com.baiyue.auth.dto.AccountManagementDtos;
|
|
import com.baiyue.auth.service.AccountManagementService;
|
|
import org.springframework.security.access.prepost.PreAuthorize;
|
|
|
|
/**
|
|
* 统一认证接口，向平台端与商户端提供登录、刷新令牌和退出登录能力。
|
|
*/
|
|
@RestController
|
|
@RequestMapping("/api/auth")
|
|
@Tag(name = "Authentication / 统一认证", description = "Unified login, token refresh and logout. / 统一登录、令牌刷新与退出。")
|
|
public class AuthController {
|
|
@Resource
|
|
private AuthService authService;
|
|
@Resource
|
|
private MerchantRegistrationService registrationService;
|
|
@Resource
|
|
private AccountManagementService accountManagementService;
|
|
@PutMapping("/password")
|
|
@PreAuthorize("isAuthenticated()")
|
|
@Operation(summary = "修改当前用户密码")
|
|
public ApiResponse<Void> changePassword(@AuthenticationPrincipal AuthenticatedUser user,
|
|
@Valid @RequestBody ChangePasswordRequest request) {
|
|
if (user.impersonated()) throw new BizException(ResultCode.FORBIDDEN, "代登录会话不能修改密码");
|
|
accountManagementService.changePassword(user.userId(), request);
|
|
return ApiResponse.success(null);
|
|
}
|
|
|
|
@PutMapping("/password/forced")
|
|
@PreAuthorize("isAuthenticated()")
|
|
@Operation(summary = "完成强制改密")
|
|
public ApiResponse<Void> forcedChangePassword(@AuthenticationPrincipal AuthenticatedUser user,
|
|
@Valid @RequestBody ForcedPasswordChangeRequest request) {
|
|
if (user.impersonated()) throw new BizException(ResultCode.FORBIDDEN, "代登录会话不能修改密码");
|
|
if (!user.passwordChangeRequired()) throw new BizException(ResultCode.CONFLICT, "当前账号不需要强制改密");
|
|
accountManagementService.forcedChangePassword(user.userId(), request);
|
|
return ApiResponse.success(null);
|
|
}
|
|
|
|
@SecurityRequirements
|
|
@PostMapping("/register")
|
|
@Operation(summary = "Merchant registration / 客户注册",
|
|
description = "Create a login account and enterprise profile. The supplied phone initializes both the first administrator login phone and company contact phone; they are maintained independently after creation. Only the business license and unified social credit code are required for review; legal-person ID is optional.")
|
|
public ApiResponse<MerchantRegisterResponse> register(@Valid @RequestBody MerchantRegisterRequest request) {
|
|
return ApiResponse.success(registrationService.register(request));
|
|
}
|
|
|
|
@SecurityRequirements
|
|
@Operation(summary = "Login / 登录", description = "Validate credentials and issue access and refresh tokens. / 校验账号密码并签发访问令牌和刷新令牌。")
|
|
@ApiResponses({
|
|
@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Success or authentication business failure; inspect body code / 成功或认证业务失败，按响应体 code 判断"),
|
|
})
|
|
@PostMapping("/login")
|
|
public ApiResponse<TokenResponse> login(@Valid @RequestBody LoginRequest request) {
|
|
return ApiResponse.success(authService.login(request));
|
|
}
|
|
|
|
@SecurityRequirements
|
|
@Operation(summary = "Refresh token / 刷新令牌", description = "Rotate a valid refresh token and issue a new token pair. / 轮换有效刷新令牌并签发新的令牌对。")
|
|
@ApiResponses({
|
|
@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Success or refresh-token business failure; inspect body code / 成功或刷新令牌业务失败，按响应体 code 判断")
|
|
})
|
|
@PostMapping("/refresh")
|
|
public ApiResponse<TokenResponse> refresh(@Valid @RequestBody RefreshRequest request) {
|
|
return ApiResponse.success(authService.refresh(request.refreshToken()));
|
|
}
|
|
|
|
@Operation(summary = "Logout / 退出登录", description = "Revoke the supplied refresh token. / 吊销指定刷新令牌。")
|
|
@ApiResponses({
|
|
@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Logged out / 退出成功"),
|
|
@io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "401", description = "Authentication required / 需要登录")
|
|
})
|
|
@PostMapping("/logout")
|
|
public ApiResponse<Void> logout(@Valid @RequestBody RefreshRequest request) {
|
|
authService.logout(request.refreshToken());
|
|
return ApiResponse.success(null);
|
|
}
|
|
|
|
@SecurityRequirements
|
|
@PostMapping("/impersonations/exchange")
|
|
public ApiResponse<AuthService.ImpersonationTokenResponse> exchangeImpersonation(
|
|
@Valid @RequestBody AccountManagementDtos.ImpersonationExchangeRequest request) {
|
|
return ApiResponse.success(authService.exchangeImpersonationTicket(request.code()));
|
|
}
|
|
}
|