优化

gateway-overseas/src/test/java/com/baiyue/gateway/config/RequiredClaimsJwtValidatorTest.java

@@ -4,6 +4,7 @@ import org.junit.jupiter.api.Test;
 import org.springframework.security.oauth2.jwt.Jwt;
 
 import java.time.Instant;
+import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
@@ -20,14 +21,58 @@ class RequiredClaimsJwtValidatorTest {
         assertThat(validator.validate(jwt(false)).hasErrors()).isTrue();
     }
 
+    @Test
+    void rejectsMissingAuthorities() {
+        Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("1001")
+            .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
+            .claim("tenant_id", "0").claim("app_code", "PLATFORM").claim("permission_version", 3L)
+            .build();
+        assertThat(validator.validate(value).hasErrors()).isTrue();
+    }
+
+    @Test
+    void acceptsEmptyAuthoritySnapshotAndLeavesAuthorizationToControllers() {
+        assertThat(validator.validate(jwt("0", "PLATFORM", List.of(), true)).hasErrors()).isFalse();
+    }
+
+    @Test
+    void acceptsMerchantIdentityOnlyWithPositiveCustomerScope() {
+        assertThat(validator.validate(jwt("2001", "MERCHANT", List.of("merchant:order:list"), true)).hasErrors())
+            .isFalse();
+    }
+
+    @Test
+    void rejectsApplicationAndCustomerScopeMismatch() {
+        assertThat(validator.validate(jwt("2001", "PLATFORM", List.of("platform:test:list"), true)).hasErrors())
+            .isTrue();
+        assertThat(validator.validate(jwt("0", "MERCHANT", List.of("merchant:test:list"), true)).hasErrors())
+            .isTrue();
+    }
+
+    @Test
+    void rejectsMalformedIdentityAndPermissionVersion() {
+        Jwt value = Jwt.withTokenValue("token").header("alg", "RS256").subject("not-a-user")
+            .issuedAt(Instant.now()).expiresAt(Instant.now().plusSeconds(300))
+            .claim("tenant_id", "0").claim("app_code", "PLATFORM").claim("permission_version", -1L)
+            .claim("authorities", List.of()).build();
+        assertThat(validator.validate(value).hasErrors()).isTrue();
+    }
+
     private Jwt jwt(boolean includePermissionVersion) {
+        return jwt("0", "PLATFORM",
+            List.of("platform:overseas-warehouse:inventory:list"), includePermissionVersion);
+    }
+
+    private Jwt jwt(String tenantId, String appCode, List<String> authorities,
+                    boolean includePermissionVersion) {
         Jwt.Builder builder = Jwt.withTokenValue("token")
                 .header("alg", "RS256")
                 .subject("1001")
                 .issuedAt(Instant.now())
                 .expiresAt(Instant.now().plusSeconds(300))
-                .claim("tenant_id", "2001")
-                .claim("app_code", "PLATFORM");
+                .claim("tenant_id", tenantId)
+                .claim("app_code", appCode)
+                .claim("authorities", authorities);
         if (includePermissionVersion) {
             builder.claim("permission_version", 3L);
         }